Overview
overview
10Static
static
3UIgt876tUH...67.exe
windows10-ltsc 2021-x64
10UIgt876tUH...12.exe
windows10-ltsc 2021-x64
10UIgt876tUH...44.exe
windows10-ltsc 2021-x64
10UIgt876tUH...85.exe
windows10-ltsc 2021-x64
10UIgt876tUH...05.exe
windows10-ltsc 2021-x64
10UIgt876tUH...18.exe
windows10-ltsc 2021-x64
10UIgt876tUH...55.exe
windows10-ltsc 2021-x64
10UIgt876tUH...02.exe
windows10-ltsc 2021-x64
10UIgt876tUH...35.exe
windows10-ltsc 2021-x64
10UIgt876tUH...36.exe
windows10-ltsc 2021-x64
10UIgt876tUH...14.exe
windows10-ltsc 2021-x64
10UIgt876tUH...25.exe
windows10-ltsc 2021-x64
10UIgt876tUH...78.exe
windows10-ltsc 2021-x64
10UIgt876tUH...17.exe
windows10-ltsc 2021-x64
10UIgt876tUH...24.exe
windows10-ltsc 2021-x64
10UIgt876tUH...75.exe
windows10-ltsc 2021-x64
10UIgt876tUH...26.exe
windows10-ltsc 2021-x64
10UIgt876tUH...78.exe
windows10-ltsc 2021-x64
10UIgt876tUH...21.exe
windows10-ltsc 2021-x64
10UIgt876tUH...11.exe
windows10-ltsc 2021-x64
10UIgt876tUH...41.exe
windows10-ltsc 2021-x64
10UIgt876tUH...83.exe
windows10-ltsc 2021-x64
10UIgt876tUH...28.exe
windows10-ltsc 2021-x64
10UIgt876tUH...18.exe
windows10-ltsc 2021-x64
10UIgt876tUH...40.exe
windows10-ltsc 2021-x64
10UIgt876tUH...21.exe
windows10-ltsc 2021-x64
10UIgt876tUH...35.exe
windows10-ltsc 2021-x64
10UIgt876tUH...00.exe
windows10-ltsc 2021-x64
10UIgt876tUH...22.exe
windows10-ltsc 2021-x64
10UIgt876tUH...35.exe
windows10-ltsc 2021-x64
10UIgt876tUH...94.exe
windows10-ltsc 2021-x64
10UIgt876tUH...83.exe
windows10-ltsc 2021-x64
10Resubmissions
25-11-2024 17:16
241125-vtdf9stnhk 1025-11-2024 17:16
241125-vtbbxaxmcz 1024-11-2024 19:50
241124-yj992aslbl 10Analysis
-
max time kernel
1200s -
max time network
1203s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
25-11-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/AC5zel3AV7vA8b64BXxHmBpuqvCVrl_793412.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral3
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/FZC18z1mmOSrfGmgRohsEa8b87QKyK_004944.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral4
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/H9zMDiucu4hoAtgomWFd5CAHBZ89AR_233385.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/IbxyHSgPkKXhHO3XECSuXtrGrP78dY_051705.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral6
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/JWPdwAR7tf5F2I2M0XlaUFZpXkDHYS_248818.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral7
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral8
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SKR8Xe9D0cXCZDZPbZkg8tz0KL8VIp_015702.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral9
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SMFjVyESw8I9PTvLFZFVsEVapqgviY_867235.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral10
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/T78QQDbK2Slo8gJ2UXctsrxPxHgjGt_467036.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral11
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VD0HrhXsggfxjVhZKwKvFcUgZngYpL_725314.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral12
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VMaiSLAgN8PSkdeOBll7ujSMJqtL0B_784725.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral13
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/YHgiq8V6Fe1kWFfxgebX0tkrZhzCzu_920778.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral14
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral15
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral16
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/d4DRbF4lHfHnECxCaAJjnsHMjvRUuT_697575.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral17
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/dH0vwJrfFCMTza8GNwvojfVVLEOsFO_754126.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral18
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/g9sj08YZGrYURlSuoHSBfD2nMsxYwq_451878.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral19
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/gEGj0hrvo86NOP4C6uFjuQZGc7L9SD_033621.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral20
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/i1PZKF5Ty5Z4JG8hL2JcygPplPihXS_988211.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral21
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral22
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/ksggHuRICgGdy4hFQ7TQRtRAFrmo9g_005883.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral23
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/lpxGanhj9mp46k1kUv9pBlExkpxjRo_341428.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral24
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/mF2M6MDHwuDSA5ImXG8llsrjkmC05f_743618.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral25
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/nAUgDpjI6p9TJ1s2ecjTDpXBQyXXtZ_398840.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral26
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral27
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/sjcH0YxZZOOsABx58ITvg1uPWbRbE8_934035.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral28
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/t5bQ9k2jwSWS8mOCFHDsDjImPq05eW_436400.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral29
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/tNL1iZslogiTHVT4WoLJnOIUxfb1y9_736622.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral30
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/wNGm7TKEGTauV0JK3s4EJDeiQqLRyr_259035.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral31
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/xriqKcYplsVMajrABwapyatwUlnHT5_216294.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
General
-
Target
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe
-
Size
4.9MB
-
MD5
e91d4caf2fdb4882f2765fca3df7d3ab
-
SHA1
3ff37b771bd4a7b7958456a5d7a92513a5e5c484
-
SHA256
7d821b4d7f35ceb933fcda3347e4dbeff62de35381f29e2781e74034d0a7a6e8
-
SHA512
fb717c3defebff2bf653a2401d874a9a5fd399e5ab6f5edb188b791ced0e1c658f732945a4f8e8c5f20ac8bfb9fd6c8c29d892917c124bc74e4db6e342ab1020
-
SSDEEP
98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTP:B/n03MdR8DB0OU0Fp2CYubab
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral7/memory/3888-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-14-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-17-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-18-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-20-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-23-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-24-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral7/memory/3888-25-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2224 set thread context of 3888 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe 86 -
resource yara_rule behavioral7/memory/3888-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-14-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-17-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-18-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-19-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-20-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-23-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-24-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral7/memory/3888-25-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3888 explorer.exe Token: SeLockMemoryPrivilege 3888 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2224 wrote to memory of 3888 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe 86 PID 2224 wrote to memory of 3888 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe 86 PID 2224 wrote to memory of 3888 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe 86 PID 2224 wrote to memory of 3888 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe 86 PID 2224 wrote to memory of 3888 2224 LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe"C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3888
-