Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 10:28
General
-
Target
gaozw40v.exe
-
Size
5.0MB
-
MD5
7d8f7b0c924a228c2ca81d3959d0b604
-
SHA1
972eae6c3f80dd0be06fb73bb64553cd10360873
-
SHA256
95c1d9dd76abc999cf76d0acc7f2c59205e95cf6a96d3867328628dc7289db48
-
SHA512
6c5b93313fabc4bc0aab93da27bcbabb422fceef2bca9185d0cdc4e634240df9699b05389308e06ddedc604430a6c0164de8763b35d1268dce37e052c2c4bb81
-
SSDEEP
98304:VNvN3Y8Dz2X5ny7kOywy+VHoJzeDBuqgeYY8S91anzz9oq+T:FnaX5nfitVuzUBuDH88zpUT
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 8 IoCs
-
Creates new service(s) 2 TTPs
-
Stops running service(s) 4 TTPs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gaozw40v.exe"C:\Users\Admin\AppData\Local\Temp\gaozw40v.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "YIFRWLJF"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "YIFRWLJF" binpath= "C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "YIFRWLJF"2⤵
- Launches sc.exe
-
-
C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exeC:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD57d8f7b0c924a228c2ca81d3959d0b604
SHA1972eae6c3f80dd0be06fb73bb64553cd10360873
SHA25695c1d9dd76abc999cf76d0acc7f2c59205e95cf6a96d3867328628dc7289db48
SHA5126c5b93313fabc4bc0aab93da27bcbabb422fceef2bca9185d0cdc4e634240df9699b05389308e06ddedc604430a6c0164de8763b35d1268dce37e052c2c4bb81
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB