Analysis

  • max time kernel
    119s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2025, 16:51

General

  • Target

    46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe

  • Size

    4.0MB

  • MD5

    31a83c4de46c4876b92f1595fad89131

  • SHA1

    8ce492419d3394c6c183c03e8fdd9c45411cf44a

  • SHA256

    46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695

  • SHA512

    47521feb3782448682e857571634b8ce8be1d5ee528e3d1851356433da216059a3bc226d96f68ad1cac017d97281fb0ddc831d8243385f878decb693a10f51f3

  • SSDEEP

    49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2o:RWWBibf56utgpPFotBER/mQg

Score
10/10

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 12 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe
    "C:\Users\Admin\AppData\Local\Temp\46dba98aa0946da180f8f1beac1116d6859d2dbcd36f6d3c9583dda7a7a0c695.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2660-0-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-1-0x00000000002F0000-0x0000000000300000-memory.dmp

    Filesize

    64KB

  • memory/2660-2-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-3-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-4-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-5-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-6-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-7-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-8-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-9-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-10-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-11-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-12-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB

  • memory/2660-13-0x000000013F7F0000-0x000000013FB41000-memory.dmp

    Filesize

    3.3MB