Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 02:17

General

  • Target

    71cefea87e620a5fbef23fc1cebed9558646077b3a9d7af74f901a96c0520667.exe

  • Size

    16.9MB

  • MD5

    aede5b115882e8f128bc5dfed0afb87b

  • SHA1

    62e50003d787d1e125309e0d71b398245e310700

  • SHA256

    71cefea87e620a5fbef23fc1cebed9558646077b3a9d7af74f901a96c0520667

  • SHA512

    0c51f1b096dce46ee890ca103ccaeb5aa849f2f31f2a876adf128bf961bacff7060ace533bbb5709da85bed11027967c3499389faa97daf7d108eead1126c275

  • SSDEEP

    196608:dSwhUq4hKQ+U84BVPeeMAIghZaViMNbJJOKH/rT9EZY+RAMO418g4nEd7d2Of37J:dT4V+0nNZaViMpzO4n+d54nEdB9NoC

Score
10/10

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71cefea87e620a5fbef23fc1cebed9558646077b3a9d7af74f901a96c0520667.exe
    "C:\Users\Admin\AppData\Local\Temp\71cefea87e620a5fbef23fc1cebed9558646077b3a9d7af74f901a96c0520667.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2096-0-0x000000013FB04000-0x0000000140424000-memory.dmp

    Filesize

    9.1MB

  • memory/2096-10-0x0000000077B00000-0x0000000077B02000-memory.dmp

    Filesize

    8KB

  • memory/2096-8-0x0000000077B00000-0x0000000077B02000-memory.dmp

    Filesize

    8KB

  • memory/2096-6-0x0000000077B00000-0x0000000077B02000-memory.dmp

    Filesize

    8KB

  • memory/2096-5-0x0000000077AF0000-0x0000000077AF2000-memory.dmp

    Filesize

    8KB

  • memory/2096-3-0x0000000077AF0000-0x0000000077AF2000-memory.dmp

    Filesize

    8KB

  • memory/2096-1-0x0000000077AF0000-0x0000000077AF2000-memory.dmp

    Filesize

    8KB

  • memory/2096-16-0x000000013FB04000-0x0000000140424000-memory.dmp

    Filesize

    9.1MB

  • memory/2096-13-0x000000013F3E0000-0x0000000141503000-memory.dmp

    Filesize

    33.1MB

  • memory/2096-17-0x000000013F3E0000-0x0000000141503000-memory.dmp

    Filesize

    33.1MB

  • memory/2096-15-0x00000000001F0000-0x0000000000210000-memory.dmp

    Filesize

    128KB

  • memory/2096-18-0x000000013F3E0000-0x0000000141503000-memory.dmp

    Filesize

    33.1MB