MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46c9851a885a5107ee0e777e5603c2dee3444616eb6a9ec23c63434c7236c7ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46c9851a885a5107ee0e777e5603c2dee3444616eb6a9ec23c63434c7236c7ca
SHA3-384 hash: 97767d40f421064b15b033454f89245168bf156bbd03946f7d62d10c3e92acabc60a928fbb88acf795c8f1fb34cbdb14
SHA1 hash: 5aada85219fef1b02e36a71abdac72cca0df0e94
MD5 hash: f56f2a981ebdde8492edf448bb1351e1
humanhash: mountain-nuts-colorado-bluebird
File name:Windows_Defender.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:4'519'936 bytes
First seen:2022-06-06 11:05:55 UTC
Last seen:2022-06-06 12:03:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7dbd2319b33ed25eb7ad7d0162c2bb3a (18 x CoinMiner, 1 x CoinMiner.XMRig, 1 x XFilesStealer)
ssdeep 98304:vQZ55FN0jSzQNbHabWxaCkJyEzodsjjKLRGnkSa:05FuLhHabWxLyaddLRGnO
Threatray 263 similar samples on MalwareBazaar
TLSH T18A2633FD6381076BE242C578A70A7BC3FA9E36166D5D66422FAC11C1CD7C6211FA09BC
TrID 59.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.3% (.EXE) OS/2 Executable (generic) (2029/13)
7.2% (.EXE) Generic Win/DOS Executable (2002/3)
7.2% (.EXE) DOS Executable Generic (2000/1)
Reporter JAMESWT_WT
Tags:CoinMiner exe XMRIG

Intelligence

File Origin
# of uploads :
2
# of downloads :
376
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Valorant Skin Changer.exe
Verdict:
Malicious activity
Analysis date:
2022-06-05 19:59:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6aaaf24a-1372-48a3-8c3b-3ee61031579d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276977/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.32952.8743.32749.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer donut packed
Link:
https://www.filescan.io/uploads/629ddf9f824d74ef94f72b82/reports/1a80ff47-a730-41cc-bc32-eab98147765d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8ea48397-658c-473d-869a-7f6d6ee296f0
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1007277
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Creates files in the system32 config directory
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Powershell drops PE file
Sample is not signed and drops a device driver
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Very long command line found
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 639773 Sample: Windows_Defender.exe Startdate: 06/06/2022 Architecture: WINDOWS Score: 100 63 Malicious sample detected (through community Yara rule) 2->63 65 Antivirus detection for dropped file 2->65 67 Antivirus / Scanner detection for submitted sample 2->67 69 5 other signatures 2->69 8 Windows_Defender.exe 2->8         started        11 powershell.exe 2->11         started        13 svchost.exe 2->13         started        15 2 other processes 2->15 process3 signatures4 83 Writes to foreign memory regions 8->83 85 Allocates memory in foreign processes 8->85 87 Creates a thread in another existing process (thread injection) 8->87 17 conhost.exe 4 8->17         started        89 Creates files in the system32 config directory 11->89 21 Update.exe 11->21         started        23 conhost.exe 11->23         started        process5 file6 55 C:\Windows\System32\drivers\etc\hosts, ASCII 17->55 dropped 71 Very long command line found 17->71 73 Encrypted powershell cmdline option found 17->73 75 Modifies the hosts file 17->75 25 cmd.exe 1 17->25         started        28 powershell.exe 35 17->28         started        31 cmd.exe 1 17->31         started        33 powershell.exe 22 17->33         started        77 Writes to foreign memory regions 21->77 79 Allocates memory in foreign processes 21->79 81 Creates a thread in another existing process (thread injection) 21->81 35 conhost.exe 21->35         started        signatures7 process8 file9 91 Uses cmd line tools excessively to alter registry or file data 25->91 93 Uses schtasks.exe or at.exe to add and modify task schedules 25->93 95 Uses powercfg.exe to modify the power settings 25->95 37 conhost.exe 25->37         started        39 sc.exe 1 25->39         started        51 22 other processes 25->51 57 C:\Program Files\Update.exe, PE32+ 28->57 dropped 59 C:\Program Files\Update.exe:Zone.Identifier, ASCII 28->59 dropped 41 conhost.exe 28->41         started        97 Modifies power options to not sleep / hibernate 31->97 43 conhost.exe 31->43         started        45 powercfg.exe 1 31->45         started        47 powercfg.exe 1 31->47         started        53 2 other processes 31->53 99 Powershell drops PE file 33->99 49 conhost.exe 33->49         started        61 C:\Program Filesbehaviorgraphoogle\Libs\WR64.sys, PE32+ 35->61 dropped 101 Creates files in the system32 config directory 35->101 103 Modifies the context of a thread in another process (thread injection) 35->103 105 Sample is not signed and drops a device driver 35->105 107 2 other signatures 35->107 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46c9851a885a5107ee0e777e5603c2dee3444616eb6a9ec23c63434c7236c7ca/
Threat name:
Win64.Hacktool.Sysdupate
Create hunting rule
Status:
Malicious
First seen:
2022-05-31 15:48:08 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
19 of 25 (76.00%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3eykguiljiqp3qoo57fma6c33ruirqw5nvj5qr4mnbuy4rwy7fa._file
Verdict:
malicious
Similar samples:
1d3de5af7ff87d3202b4d595ea84b7e9aa28ebca236302eed698a5773cecbb86
CoinMiner
28432c6b761d9a0d6d3a80cbeda9b6f745cf55b5a2c234737afe493d1ff11158
CoinMiner
3fd0837381babda7ef617b810457f0db32bd7c1f7e345480e6c525050ca818fa
CoinMiner
529831a3e5b7b61f74f7a426e828210017daf1eea2cbf7cf997c13d82822aef8
CoinMiner
5f45f47d879bf54f44ab26b4eaafbc80cd276dd72acc648220e95cac385b6ede
CoinMiner
b043820fef215c161bb53c9c1fa9a2cd221cecc4bae58103a9327c575697760d
CoinMiner
c73a91a1fdfa8b8ad1c4092fd33e3e84c16b568ae622996891d573bb449eec04
CoinMiner
ee1524e4980cac431ae0f92888ee0cc8a1fa9e7981df0be6abd7efa98adf9a45
CoinMiner
f6db67d86284b56e01a696535996455416a4e86ec12b923721771d010210c487
CoinMiner
+ 253 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig discovery evasion exploit miner
Link:
https://tria.ge/reports/220606-m7ebqaffb2/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Modifies file permissions
Drops file in Drivers directory
Executes dropped EXE
Possible privilege escalation attempt
Stops running service(s)
XMRig Miner Payload
Modifies security service
xmrig
Unpacked files
SH256 hash:
46c9851a885a5107ee0e777e5603c2dee3444616eb6a9ec23c63434c7236c7ca
MD5 hash:
f56f2a981ebdde8492edf448bb1351e1
SHA1 hash:
5aada85219fef1b02e36a71abdac72cca0df0e94
Link:
https://www.unpac.me/results/5ddaa456-06b9-46b2-8161-df8ed71e3e5f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/46c9851a885a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/46c9851a885a5107ee0e777e5603c2dee3444616eb6a9ec23c63434c7236c7ca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 46c9851a885a5107ee0e777e5603c2dee3444616eb6a9ec23c63434c7236c7ca

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2227061/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/276977/

Comments