Analysis
-
max time kernel
299s -
max time network
282s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
28/12/2024, 14:13
General
-
Target
aaadri.exe
-
Size
2.5MB
-
MD5
9f36b71007f45e5798edb2a7c69a9173
-
SHA1
57ee352beacae902816516ab7d3a881e56fb456c
-
SHA256
1d2ee5ac64af7f3c1201f6819e460c03c65da6c81a7b69e3ae84bad9a1226cb5
-
SHA512
62dbec2107ff46536311d5937381f8181aba350b7f39cde586cecfa115243d40f1f7b71b8337403b179678e1bb4b6c2c27c1f749aa88f9c3c23efd063449813e
-
SSDEEP
49152:Uu2niGtF/++JGq24/Tz40hDqFSw1AXRuA08BgWrio3c13H6Lzw40zhY2L:vyiGtF/FAMTsIDhuy0KoXO2
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 9 IoCs
-
Creates new service(s) 2 TTPs
-
Stops running service(s) 4 TTPs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaadri.exe"C:\Users\Admin\AppData\Local\Temp\aaadri.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RMVHEKXW"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RMVHEKXW" binpath= "C:\ProgramData\vlvpbvfemslu\yhlcpcgmvvxx.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "RMVHEKXW"2⤵
- Launches sc.exe
-
-
C:\ProgramData\vlvpbvfemslu\yhlcpcgmvvxx.exeC:\ProgramData\vlvpbvfemslu\yhlcpcgmvvxx.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD59f36b71007f45e5798edb2a7c69a9173
SHA157ee352beacae902816516ab7d3a881e56fb456c
SHA2561d2ee5ac64af7f3c1201f6819e460c03c65da6c81a7b69e3ae84bad9a1226cb5
SHA51262dbec2107ff46536311d5937381f8181aba350b7f39cde586cecfa115243d40f1f7b71b8337403b179678e1bb4b6c2c27c1f749aa88f9c3c23efd063449813e
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
128KB