ScreenShot
| Created | 2023.06.09 11:05 | Machine | s1_win7_x6403 |
| Filename | xmrig.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 56 detected (AIDetect, malware2, Dacic, BitCoinMiner, Temr, GenericRI, S8512615, GenericRXMB, Unsafe, Swisyn, Save, Coinminer, malicious, MadoMiner, Eldorado, Attribute, HighConfidence, moderate confidence, FlyStudio, score, Graftor, dwyqeb, FileRepMalware, Ymhl, MUPX, Gen@24tbus, Siggen8, Flyagent, high, AGEN, ai score=85, ASCommon, kcloud, RiskTool, BitMiner, 10S0A6W, Detected, R431774, ZexaF, 5oKfaG1QWcab, BScope, Miner, HackTool, XMRMiner, CLOUD, Static AI, Malicious PE, susgen, GdSda) | ||
| md5 | 1e7094119ed8a4415c7549c19d771a71 | ||
| sha256 | 1dbe16e04438694c62bb747d0073bf463a2a9525f6b637432d2f1381dad04608 | ||
| ssdeep | 49152:g4A6TH7YA/AoKRQvdTq4WpYlV7QdJUqxU5b+5318PNSC8uDo:lFr7lINRqpq47lVAJM5g1OYCFs | ||
| imphash | f61687272ede04042da2ed03fc12db7b | ||
| impfuzzy | 6:omRgsyIBM9IVA7ZBJAEoZ/OEGDzyRPLMKJAmzRjLbtuISXmJJcJOl:omRghIBAIVOABZG/DzA+m9xutX+mOl | ||
Network IP location
Signature (18cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 56 AntiVirus engines on VirusTotal as malicious |
| watch | Created a service where a service was also not started |
| watch | Installs itself for autorun at Windows startup |
| watch | The process wscript.exe wrote an executable file to disk |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Creates hidden or system file |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Foreign language identified in PE resource |
| notice | Resolves a suspicious Top Level Domain (TLD) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is compressed using UPX |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
Rules (10cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET DNS Query to a *.pw domain - Likely Hostile
PE API
IAT(Import Address Table) Library
ADVAPI32.dll
0xdf63f8 RegCloseKey
COMCTL32.dll
0xdf6400 None
comdlg32.dll
0xdf6408 ChooseColorA
GDI32.dll
0xdf6410 PatBlt
KERNEL32.DLL
0xdf6418 LoadLibraryA
0xdf641c ExitProcess
0xdf6420 GetProcAddress
0xdf6424 VirtualProtect
ole32.dll
0xdf642c OleInitialize
OLEAUT32.dll
0xdf6434 LoadTypeLib
SHELL32.dll
0xdf643c ShellExecuteA
USER32.dll
0xdf6444 GetDC
WINMM.dll
0xdf644c waveOutOpen
WINSPOOL.DRV
0xdf6454 ClosePrinter
WS2_32.dll
0xdf645c inet_ntoa
EAT(Export Address Table) is none
ADVAPI32.dll
0xdf63f8 RegCloseKey
COMCTL32.dll
0xdf6400 None
comdlg32.dll
0xdf6408 ChooseColorA
GDI32.dll
0xdf6410 PatBlt
KERNEL32.DLL
0xdf6418 LoadLibraryA
0xdf641c ExitProcess
0xdf6420 GetProcAddress
0xdf6424 VirtualProtect
ole32.dll
0xdf642c OleInitialize
OLEAUT32.dll
0xdf6434 LoadTypeLib
SHELL32.dll
0xdf643c ShellExecuteA
USER32.dll
0xdf6444 GetDC
WINMM.dll
0xdf644c waveOutOpen
WINSPOOL.DRV
0xdf6454 ClosePrinter
WS2_32.dll
0xdf645c inet_ntoa
EAT(Export Address Table) is none