Analysis
-
max time kernel
119s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 16:51
Behavioral task
behavioral1
Sample
46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe
Resource
win7-20240903-en
5 signatures
120 seconds
General
-
Target
46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe
-
Size
4.0MB
-
MD5
31a83c4de46c4876b92f1595fad89131
-
SHA1
8ce492419d3394c6c183c03e8fdd9c45411cf44a
-
SHA256
46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695
-
SHA512
47521feb3782448682e857571634b8ce8be1d5ee528e3d1851356433da216059a3bc226d96f68ad1cac017d97281fb0ddc831d8243385f878decb693a10f51f3
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2o:RWWBibf56utgpPFotBER/mQg
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/2660-2-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-3-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-4-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-5-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-6-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-7-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-8-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-9-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-10-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-11-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-12-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig behavioral1/memory/2660-13-0x000000013F7F0000-0x000000013FB41000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/2660-0-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-2-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-3-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-4-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-5-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-6-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-7-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-8-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-9-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-10-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-11-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-12-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx behavioral1/memory/2660-13-0x000000013F7F0000-0x000000013FB41000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2660 46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe Token: SeLockMemoryPrivilege 2660 46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe