MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1c3e42f794ea8db905580fa5ac184a3d06cba1ab0ac47d6bd686c24fe0b6c99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1c3e42f794ea8db905580fa5ac184a3d06cba1ab0ac47d6bd686c24fe0b6c99
SHA3-384 hash: 75b11bfcc7582b8aa51e5f7f36d40a0a5d12ab293fd7e78f1ec3965230764fe4a3a44ab83f545f739dd9af250e75f9ee
SHA1 hash: 1f415f3eaff6042926f67f5b9781181987261dc6
MD5 hash: b42def3dcbb6b43380ad239453c62450
humanhash: pasta-alaska-monkey-nitrogen
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'035'648 bytes
First seen:2023-01-15 12:28:31 UTC
Last seen:2023-01-15 14:41:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d867fbecbd5bc25e2449399ab2b2dea (1 x CoinMiner)
ssdeep 49152:hfl2at7e0TgVpfPXc7p0qNsJAGiBNUo0rwRgnpm6eEssrB:Zl2at7et7PXc7p0qCSGiBe1fM6M4
Threatray 2'850 similar samples on MalwareBazaar
TLSH T129E5BF41F29444B8EDABC1714E6A9A1AA735BC201B5087CB136BF5AD0F333C15E35B6E
File icon (PE):PE icon
dhash icon f0b4e6b2a2789ae8 (2 x CoinMiner)
Reporter andretavare5
Tags:CoinMiner exe


Avatar
andretavare5
Sample downloaded from http://orderedami.com/svcrun.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-15 12:30:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cce3529f-06a7-43ed-aff6-109e9d6a89c3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353079/
Detection(s):
ditekSHen.MALWARE.Win.Trojan.NWorm.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
Launching a process
Creating a file
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug explorer.exe greyware hacktool keylogger overlay packed packed rundll32.exe shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/63c3f190fdb7473299628e09/reports/7c83d130-d38b-4fc7-a0a1-4fe68d9e7ab0/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/85401b24-33a5-451a-8da4-6dc5ab6dbf5c
Result
Threat name:
EICAR, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1151888
Signature
Adds a directory exclusion to Windows Defender
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected unpacking (changes PE section rights)
DNS related to crypt mining pools
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May modify the system service descriptor table (often done to hook functions)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sets debug register (to hijack the execution of another thread)
Sigma detected: Xmrig
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected EICAR
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 784620 Sample: file.exe Startdate: 15/01/2023 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Sigma detected: Xmrig 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 8 other signatures 2->42 7 file.exe 14 8 2->7         started        12 TSMSOQO.exe 2->12         started        process3 dnsIp4 30 179.43.140.229, 49696, 80 PLI-ASCH Panama 7->30 28 C:\ProgramData\datajs\TSMSOQO.exe, PE32+ 7->28 dropped 44 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->44 46 Sets debug register (to hijack the execution of another thread) 7->46 48 Writes to foreign memory regions 7->48 58 3 other signatures 7->58 14 vbc.exe 7->14         started        18 cmd.exe 1 7->18         started        20 powershell.exe 20 7->20         started        50 Detected unpacking (changes PE section rights) 12->50 52 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->52 54 Tries to evade debugger and weak emulator (self modifying code) 12->54 56 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 12->56 file5 signatures6 process7 dnsIp8 32 51.15.65.182, 14433, 49697 OnlineSASFR France 14->32 34 xmr-eu1.nanopool.org 14->34 60 Query firmware table information (likely to detect VMs) 14->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 18->62 22 conhost.exe 18->22         started        24 schtasks.exe 1 18->24         started        26 conhost.exe 20->26         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1c3e42f794ea8db905580fa5ac184a3d06cba1ab0ac47d6bd686c24fe0b6c99/
Threat name:
Win64.Trojan.Tasker
Create hunting rule
Status:
Malicious
First seen:
2023-01-15 12:29:11 UTC
File Type:
PE+ (Exe)
Extracted files:
204
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4hb6il3zj2unxecvqd5fvqmeupigzoq2wcwepvv5nbwcj7qlnsmq._file
Verdict:
unknown
Similar samples:
30e8c6d27c13e55b19944bbd5b3c044a633c386fa00616e7b80ae1c9700c8c1c
CoinMiner
5a6f5d425060a2bfc152e1c2673991151e8863354deb3c4febd60ce42a80f35e
CoinMiner
6685f11a3c1fc098fa7d1097d09d417ed4051a654f99acf0d59fa8f3d1fdcbab
CoinMiner
6a77de3bb22e3d1be670e01a037f8db140109d3e66c9043e264c83649b169269
CoinMiner
6e350cf33445a9e5c616c29a1cccbd737b9cdb10f76099f7a5dcde292c228d33
CoinMiner
6f0be85cffdd59d4a1d520b6985820b6a62ad3978d3325be19b0c2f0e58dea14
CoinMiner
97dd4d5ad20ddc554faf0cf0bb5bfa252cd8a0b1734bd795124edf71623b98d7
CoinMiner
9d4888ece611891fb0343b8c003703a4ec653031585a2c578b3bb525683b3b9a
CoinMiner
b5ed948dd84aa5fdecf011400ced88f20a8c376795672445c41275a974f26318
CoinMiner
+ 2'840 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/230115-pnwsrsae8v/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Uses the VBS compiler for execution
XMRig Miner payload
xmrig
Unpacked files
SH256 hash:
e1c3e42f794ea8db905580fa5ac184a3d06cba1ab0ac47d6bd686c24fe0b6c99
MD5 hash:
b42def3dcbb6b43380ad239453c62450
SHA1 hash:
1f415f3eaff6042926f67f5b9781181987261dc6
Link:
https://www.unpac.me/results/2f934be5-a558-4043-ad10-7e5612266ed6/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e1c3e42f794e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/e1c3e42f794ea8db905580fa5ac184a3d06cba1ab0ac47d6bd686c24fe0b6c99

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:win_xfilesstealer_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.xfilesstealer.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2497706/
Cape
Cape
https://www.capesandbox.com/analysis/353079/

Comments