MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37c3db846b611722768b95c17585624f476def65d0332b3cfb93709c1273a685. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37c3db846b611722768b95c17585624f476def65d0332b3cfb93709c1273a685
SHA3-384 hash: 3f68389a3a9a46bfb513ba6d9ea69a18746bc61ee6a628c48a806b2b69760f0832bab7ab6c2e37e2930bd0151fc70210
SHA1 hash: bef350471c595da4cfc809f1d92145616876677e
MD5 hash: 9411240acd30d986d9db1eeb8d003691
humanhash: mountain-lactose-glucose-single
File name:9411240acd30d986d9db1eeb8d003691.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:374'147 bytes
First seen:2021-11-13 07:35:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 6144:8/fAhvV6B8ErzPZp5wdz753RSkKJUH4C7xkzvrO9gaTv4cU1:YfAv6B8azBwdtK2H4C7CzDzas7
Threatray 1'098 similar samples on MalwareBazaar
TLSH T12D84CF02FAD284B2E57219325A39AB206A7D7D301E34DA5FB3D44D2DDA315C1B231BB3
File icon (PE):PE icon
dhash icon c070cc9cfecde976 (4 x LimeRAT, 3 x CoinMiner)
Reporter abuse_ch
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205409/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.31721986.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Deleting a recently created file
Creating a file
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Query of malicious DNS domain
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices by creating a special LNK file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cobra coinminer greyware limerat overlay packed valyria
Link:
https://www.filescan.io/uploads/618f6ae4a00afa9663a5ef5f/reports/ba3441fd-dd5c-4a82-913c-1af69ba349d2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LimeRat
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8f602061-72fc-4562-9336-ae943ed674bd
Result
Threat name:
LimeRAT Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888489
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Connects to many ports of the same IP (likely port scanning)
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Disables the Windows task manager (taskmgr)
Drops PE files with a suspicious file extension
Drops PE files with benign system names
Drops VBS files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Drops script at startup location
Sigma detected: Schedule system process
Sigma detected: Suspicious Certutil Command
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to resolve many domain names, but no domain seems valid
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Shell Script Host drops VBS files
Yara detected BatToExe compiled binary
Yara detected LimeRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 520962 Sample: Cm5XMomXqc.exe Startdate: 13/11/2021 Architecture: WINDOWS Score: 100 82 ut8apha9.servepics.com 2->82 84 ut8apha9.servegame.com 2->84 86 137 other IPs or domains 2->86 108 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->108 110 Antivirus detection for URL or domain 2->110 112 Antivirus detection for dropped file 2->112 116 22 other signatures 2->116 11 Cm5XMomXqc.exe 15 2->11         started        15 winupdate.exe 2->15         started        18 wscript.exe 2->18         started        signatures3 114 System process connects to network (likely due to code injection or exploit) 84->114 process4 dnsIp5 56 C:\Users\user\AppData\Local\...\winupdate.exe, PE32 11->56 dropped 58 C:\Users\user\AppData\...\windowsapp.exe, PE32 11->58 dropped 60 C:\Users\user\AppData\Local\Temp\...\find.exe, PE32 11->60 dropped 62 2 other malicious files 11->62 dropped 136 Drops PE files with benign system names 11->136 20 windowsapp.exe 6 11->20         started        106 microupdate.madpath.com 54.36.158.41, 49698, 49703, 80 OVHFR France 15->106 24 winupdate.exe 15->24         started        file6 signatures7 process8 file9 52 C:\Users\user\AppData\Local\Temp\...F31.bat, ASCII 20->52 dropped 118 Antivirus detection for dropped file 20->118 120 Machine Learning detection for dropped file 20->120 26 cmd.exe 3 5 20->26         started        54 C:\Users\user\AppData\Local\...\WinUpdate.exe, PE32 24->54 dropped signatures10 process11 signatures12 132 Uses ping.exe to sleep 26->132 134 Uses ping.exe to check the status of other devices and networks 26->134 29 csrss.exe 26->29         started        33 wscript.exe 3 3 26->33         started        35 certutil.exe 26->35         started        38 12 other processes 26->38 process13 dnsIp14 64 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32 29->64 dropped 138 Antivirus detection for dropped file 29->138 140 Multi AV Scanner detection for dropped file 29->140 142 Machine Learning detection for dropped file 29->142 162 4 other signatures 29->162 40 svchost.exe 29->40         started        44 schtasks.exe 29->44         started        78 2 other malicious files 33->78 dropped 144 System process connects to network (likely due to code injection or exploit) 33->144 146 Windows Shell Script Host drops VBS files 33->146 148 Drops VBS files to the startup folder 33->148 150 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 33->150 46 wscript.exe 33->46         started        88 18.141.173.70, 49689, 49690, 49693 AMAZON-02US United States 35->88 66 C:\Users\user\AppData\Local\Temp\...\win.com, PE32 35->66 dropped 68 C:\Users\user\AppData\Local\...\win[1].com, PE32 35->68 dropped 70 C:\Users\...\1A8672A945AF2919B8AA70FD01E4BED0, PE32 35->70 dropped 152 Drops PE files with a suspicious file extension 35->152 90 niogem1171.servecounterstrike.com 38->90 72 C:\Users\user\AppData\...\winupdate.exe, PE32 38->72 dropped 74 C:\Users\user\AppData\Local\Temp\...\64a1.com, PE32 38->74 dropped 76 C:\Users\user\AppData\Local\Temp\...\find.exe, PE32 38->76 dropped 80 4 other malicious files 38->80 dropped 154 Creates multiple autostart registry keys 38->154 156 Creates an autostart registry key pointing to binary in C:\Windows 38->156 158 Disables the Windows task manager (taskmgr) 38->158 48 wscript.exe 38->48         started        file15 160 Connects to a pastebin service (likely for C&C) 90->160 signatures16 process17 dnsIp18 100 2 other IPs or domains 40->100 122 Antivirus detection for dropped file 40->122 124 System process connects to network (likely due to code injection or exploit) 40->124 126 Protects its processes via BreakOnTermination flag 40->126 130 2 other signatures 40->130 50 conhost.exe 44->50         started        92 ut8apha9.myvnc.com 46->92 94 ut8apha9.freedynamicdns.org 46->94 102 146 other IPs or domains 46->102 96 muslada2251.viewdns.net 48->96 98 muslada2251.sytes.net 48->98 104 149 other IPs or domains 48->104 signatures19 128 Tries to resolve many domain names, but no domain seems valid 98->128 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37c3db846b611722768b95c17585624f476def65d0332b3cfb93709c1273a685/
Threat name:
ByteCode-MSIL.Backdoor.LimeRAT
Create hunting rule
Status:
Malicious
First seen:
2021-11-12 07:29:00 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50
CoinMiner
13979361d20b6c7184a7d3a8e5454782162a4ab734d2f9a01ed8421aeea5eee9
CoinMiner
452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0
CoinMiner
4e41b23135ccd630532e143f5b6d41ae6d050b284fceaef1ef959e2414cf7c9a
CoinMiner
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
CoinMiner
a045c1cc2b85a5106a89a970262a3ba07dc65d96573401f1f31b4f9867ba7130
CoinMiner
b5e39716f576e5ff21e945560a98ee7ca7309491b2b7f2643728cd341b9c19de
CoinMiner
d98190863e8f53c385de8531ac7e5e89dc61cdaf17df688614ded12c24c78d31
CoinMiner
dc8ddcd4db035fa647001a01cab6a2866d092fcaad18279835751ee0396da041
CoinMiner
+ 1'088 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:limerat family:xmrig evasion miner persistence rat
Link:
https://tria.ge/reports/211113-je9elsegb6/
Behaviour
Creates scheduled task(s)
Modifies registry class
Modifies registry key
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Disables Task Manager via registry modification
Downloads MZ/PE file
Executes dropped EXE
XMRig Miner Payload
LimeRAT
xmrig
Unpacked files
SH256 hash:
e0b7e44012f966f8454596039bb23f0e2509e1003804631e2306cb63ab2d7aa0
MD5 hash:
11e48076867b6deb391f5514fc36bf9f
SHA1 hash:
6368406dd6a6e85f08f959c68957f05ec7466ab0
Detections:
win_koadic_auto
Create hunting rule
Link:
https://www.unpac.me/results/402b2baf-b318-4c7e-9f50-8cfa1e11bafa/
SH256 hash:
37c3db846b611722768b95c17585624f476def65d0332b3cfb93709c1273a685
MD5 hash:
9411240acd30d986d9db1eeb8d003691
SHA1 hash:
bef350471c595da4cfc809f1d92145616876677e
Link:
https://www.unpac.me/results/402b2baf-b318-4c7e-9f50-8cfa1e11bafa/
Malware family:
XMRIG
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/37c3db846b61/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/205409/

Comments