MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4
SHA3-384 hash: 559f796b4d95458e1390c6ca73dd4f824ba1d5a506b2da68e18a26687bef9878311def2580ee02487a7b8a4c4b975c26
SHA1 hash: 65842d5ed43a4075b39efba435293cf5c63f95eb
MD5 hash: 33020b2065b1ceb12e7ffcd7c34a9a72
humanhash: angel-sweet-muppet-alaska
File name:Krnl.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:5'296'640 bytes
First seen:2024-05-03 08:56:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b237ac2118704db9e7609540658f5790 (28 x CoinMiner)
ssdeep 98304:I45WFQt0Zx+CghgZCEiDWJbmuM7UHzq2yjYS8gkBeJQLMWmLlFJN70tfmZBRAfkV:3AFbHTiDGbmu9nS89LMX5FzWODfPpH
Threatray 209 similar samples on MalwareBazaar
TLSH T1143623B7E38C6539E0A29479BC551BF30B67A9A207DB1BDA0F83CD33D8242C511799C6
TrID 49.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
31.8% (.EXE) Win64 Executable (generic) (10523/12/4)
6.1% (.EXE) OS/2 Executable (generic) (2029/13)
6.0% (.EXE) Generic Win/DOS Executable (2002/3)
6.0% (.EXE) DOS Executable Generic (2000/1)
Reporter likeastar20
Tags:CoinMiner exe miner XMRIG

Intelligence

File Origin
# of uploads :
1
# of downloads :
482
Origin country :
RO RO
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4.exe
Verdict:
Malicious activity
Analysis date:
2024-05-03 08:58:39 UTC
Tags:
miner
Link:
https://app.any.run/tasks/7ec1a61a-ab97-46a4-888d-901c089cf16d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Trojan.Genkryptik-10016533-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Deleting a system file
Running batch commands
Launching a process
Adding an exclusion to Microsoft Defender
Changing the hosts file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug coinminer
Link:
https://www.filescan.io/uploads/6634a6e0de9c2e31030a0e42/reports/9c3f5353-dddd-448e-a29c-a68d321fbcdc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e12e32a2-fb8a-49d5-ae30-83d79e2054da
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
adwa.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1435880
Signature
Adds a directory exclusion to Windows Defender
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Self deletion via cmd or bat file
Sigma detected: Disable power options
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses powercfg.exe to modify the power settings
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1435880 Sample: Krnl.exe Startdate: 03/05/2024 Architecture: WINDOWS Score: 100 68 xmr.2miners.com 2->68 70 www.google.com 2->70 72 dl.google.com 2->72 86 Multi AV Scanner detection for submitted file 2->86 88 Yara detected Xmrig cryptocurrency miner 2->88 90 Sigma detected: Stop EventLog 2->90 92 2 other signatures 2->92 9 updater.exe 1 2->9         started        13 Krnl.exe 1 3 2->13         started        15 chrome.exe 44 2->15         started        18 2 other processes 2->18 signatures3 process4 dnsIp5 60 C:\Windows\Temp\zofsbdsgxgou.sys, PE32+ 9->60 dropped 102 Multi AV Scanner detection for dropped file 9->102 104 Injects code into the Windows Explorer (explorer.exe) 9->104 106 Modifies the context of a thread in another process (thread injection) 9->106 114 3 other signatures 9->114 20 explorer.exe 9->20         started        24 powershell.exe 9->24         started        26 cmd.exe 9->26         started        36 10 other processes 9->36 62 C:\ProgramDatabehaviorgraphoogle\Chrome\updater.exe, PE32+ 13->62 dropped 64 C:\Windows\System32\drivers\etc\hosts, ASCII 13->64 dropped 108 Self deletion via cmd or bat file 13->108 110 Uses powercfg.exe to modify the power settings 13->110 112 Modifies the hosts file 13->112 28 powershell.exe 23 13->28         started        30 cmd.exe 1 13->30         started        32 cmd.exe 1 13->32         started        38 13 other processes 13->38 80 192.168.2.4, 12222, 138, 443 unknown unknown 15->80 82 239.255.255.250 unknown Reserved 15->82 66 C:\Windows\...behaviorgraphoogle.Widevine.CDM.dll, PE32+ 15->66 dropped 34 chrome.exe 15->34         started        84 127.0.0.1 unknown unknown 18->84 file6 signatures7 process8 dnsIp9 74 xmr.2miners.com 162.19.139.184, 12222, 49744 CENTURYLINK-US-LEGACY-QWESTUS United States 20->74 94 System process connects to network (likely due to code injection or exploit) 20->94 96 Query firmware table information (likely to detect VMs) 20->96 98 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->98 40 conhost.exe 24->40         started        50 2 other processes 26->50 100 Loading BitLocker PowerShell Module 28->100 42 conhost.exe 28->42         started        52 2 other processes 30->52 44 conhost.exe 32->44         started        46 wusa.exe 32->46         started        76 www.google.com 142.250.80.100, 443, 49733, 49734 GOOGLEUS United States 34->76 78 142.251.40.132, 443, 49761 GOOGLEUS United States 34->78 54 9 other processes 36->54 48 conhost.exe 38->48         started        56 12 other processes 38->56 signatures10 process11 process12 58 conhost.exe 48->58         started       
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-04-04 20:42:42 UTC
File Type:
PE+ (Exe)
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=44lu2ytxlhvb5h3ywald3m5bxedk622f7hzt2jktv36j2y2ycc2a._file
Verdict:
malicious
Similar samples:
10cae0676fcf60dbbb56266448fff13a2ed236753243fea28d41f3902863e053
CoinMiner
5601c6c97ab6e5bf0e6b5550c4bf067366e9d1b9f202e345b7fdfdd17f3a0486
CoinMiner
d8f1979b2b2a3d59db7716e40738d5d2a3d557055831e54f8e1f52079dd04aa5
CoinMiner
dfa2a1ac549c911af8183707ba1fed1e8c401f8e448ea36bb7825d03df0f4c5a
CoinMiner
fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84
CoinMiner
+ 199 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig evasion execution miner persistence upx
Link:
https://tria.ge/reports/240503-kwk9sabb8w/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Deletes itself
Executes dropped EXE
Loads dropped DLL
UPX packed file
Command and Scripting Interpreter: PowerShell
Creates new service(s)
Drops file in Drivers directory
Stops running service(s)
XMRig Miner payload
xmrig
Unpacked files
SH256 hash:
e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4
MD5 hash:
33020b2065b1ceb12e7ffcd7c34a9a72
SHA1 hash:
65842d5ed43a4075b39efba435293cf5c63f95eb
Link:
https://www.unpac.me/results/72500d8b-a3c8-4c8f-8ce6-867da25241d7/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e7174d627759/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e7174d627759ea1e9f78b0163db3a1b906af6b45f9f33d2553aefc9d635810b4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments