Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample Name: | file.exe |
| Analysis ID: | 1306004 |
| MD5: | 4007557b488d0b2061ad05e493243347 |
| SHA1: | 8b904edcee98e0e96326fbb2ab64e5eb9a285386 |
| SHA256: | ef59e29f2bf2afd60aaf48bc05341247a914996a62271febf41cb552546ac29a |
| Tags: | exe |
| Infos: |   |
 | |
Detection
Phonk Miner, Xmrig
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Phonk Miner
Yara detected Xmrig cryptocurrency miner
Malicious sample detected (through community Yara rule)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Sigma detected: Xmrig
Snort IDS alert for network traffic
Writes to foreign memory regions
Found strings related to Crypto-Mining
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Drops large PE files
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Modifies the context of a thread in another process (thread injection)
DNS related to crypt mining pools
Uses schtasks.exe or at.exe to add and modify task schedules
Queries the volume information (name, serial number etc) of a device
Yara signature match
Drops PE files to the application program directory (C:\ProgramData)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file does not import any functions
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Binary contains a suspicious time stamp
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Classification
- System is w10x64
file.exe (PID: 6332 cmdline: C:\Users\u ser\Deskto p\file.exe MD5: 4007557B488D0B2061AD05E493243347) 
cmd.exe (PID: 6364 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\tmp6 CBC.tmp.ba t"" MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 6392 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) 
timeout.exe (PID: 6508 cmdline: timeout 3 MD5: EB9A65078396FB5D4E3813BB9198CB18) - JQSZY.exe (PID: 6560 cmdline:
"C:\Progra mData\x64n etJS\JQSZY .exe" MD5: 385AD340E0BFD3368FC0F3E765E3F337) - cmd.exe (PID: 4836 cmdline:
C:\Windows \System32\ cmd.exe" / c schtasks /create / f /sc MINU TE /mo 5 / RL HIGHEST /tn "JQSZ Y" /tr "C: \ProgramDa ta\x64netJ S\JQSZY.ex e MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 4828 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 6636 cmdline:
schtasks / create /f /sc MINUTE /mo 5 /RL HIGHEST / tn "JQSZY" /tr "C:\P rogramData \x64netJS\ JQSZY.exe" MD5: 838D346D1D28F00783B7A6C6BD03A0DA) - ngen.exe (PID: 4072 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\ng en.exe -o xmr-eu1.na nopool.org :14433 -u 87N2CazJHo aY8ofHfhpK fj2SGmfMDH PXkgZNgeAr krabCc8vC8 1NNzxdN6Rj femw5TGmZ2 vbDrC6wDxq dGf7eqqYVB UpMZD --tl s --coin m onero --ma x-cpu-usag e=50 --don ate-level= 1 -opencl MD5: C204B9380D7C148DE8445501CDCB9C57)
- svchost.exe (PID: 6084 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 5280 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 1560 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- JQSZY.exe (PID: 5004 cmdline:
C:\Program Data\x64ne tJS\JQSZY. exe MD5: 385AD340E0BFD3368FC0F3E765E3F337)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| xmrig | According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
| JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
| JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
| MacOS_Cryptominer_Xmrig_241780a1 | unknown | unknown |
| |
| JoeSecurity_PhonkMiner | Yara detected Phonk Miner | Joe Security | ||
| Click to see the 10 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
| JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
| MALWARE_Win_CoinMiner02 | Detects coinmining malware | ditekSHen |
| |
| MacOS_Cryptominer_Xmrig_241780a1 | unknown | unknown |
| |
| MAL_XMR_Miner_May19_1 | Detects Monero Crypto Coin Miner | Florian Roth |
|
Bitcoin Miner |   |
|---|
| Source: | Author: Joe Security: | ||
| Timestamp: | 192.168.2.3179.43.170.23049775802852939 09/08/23-10:58:39.611934 |
| SID: | 2852939 |
| Source Port: | 49775 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | ReversingLabs: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Joe Sandbox ML: | ||
Bitcoin Miner | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | DNS query: | ||
| Source: | Static PE information: | ||
Networking | |
|---|
| Source: | Snort IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | TCP traffic: | ||
| Source: | String found in binary or memory: | ||