Dynamic Analysis Report
Created on 2024-10-01T19:34:08+00:00
OKLA.exe
Windows Exe (x86-32)
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "3 minutes" to "10 seconds" to reveal dormant functionality.
| Filters: |
There are no files for this filter
There are no files in this analysis
| File Name | Category | Type | Verdict | Actions |
|---|
| C:\Users\RDhJ0CNFevzX\Desktop\OKLA.exe | Sample File | Binary |
Malicious
|
|
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 2.40 MB |
| MD5 |
9d888c100caacfc12357442529822d76
|
| SHA1 |
08a23363919b9ff1cd140750ca9ec1a0f37bd2a5
|
| SHA256 |
234d44698cd0114d1a42d6b4025ffa9646f48f8e8e63138716e9c06b50e3fbf1
|
| SSDeep |
49152:nILLyvOacuT9fbDxw6++uxp+NqiurJoP6rZ0B1qxtVujoiJ67XoifXUGOOnx:nxzfaJ+uxp+8rZ9t8JQfEQx
|
| ImpHash |
0ae9e38912ff6bd742a1b9e5c003576a
|
Memory Dumps (2)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| okla.exe | 1 | 0x001B0000 | 0x00226FFF | Relevant Image |
|
32-bit | 0x001D3BEE |
|
|
| okla.exe | 1 | 0x001B0000 | 0x00226FFF | Process Termination |
|
32-bit | - |
|
|
| C:\Users\RDhJ0CNFevzX\Desktop\xmrig.exe | Dropped File | Binary |
Malicious
|
|
| Also Known As |
\\?\C:\Users\RDhJ0CNFevzX\Desktop\xmrig.exe (Accessed File)
xmrig.exe (Accessed File) |
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 6.06 MB |
| MD5 |
5fba8ae226b096da3b31de0e17496735
|
| SHA1 |
d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
|
| SHA256 |
ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
|
| SSDeep |
98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
|
| ImpHash |
12806e48b853545b536463546db4baa1
|
Memory Dumps (69)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| xmrig.exe | 4 | 0x7FF68A770000 | 0x7FF68B026FFF | Relevant Image |
|
64-bit | 0x7FF68AB838E0 |
|
|
| buffer | 4 | 0x147B9700000 | 0x147B971FFFF | Content Changed |
|
64-bit | - |
|
|
| buffer | 4 | 0x5266FC000 | 0x5266FFFFF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9700000 | 0x147B971FFFF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9776F00 | 0x147B9776F7F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9777200 | 0x147B97772F7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97775E0 | 0x147B977765F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97776D0 | 0x147B9777755 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9778F60 | 0x147B9779034 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9779310 | 0x147B977938F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977BBC0 | 0x147B977BCB7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977BD10 | 0x147B977BD8F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977D300 | 0x147B977D3A1 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977D960 | 0x147B977DA9F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977E7D0 | 0x147B977E987 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977F9C0 | 0x147B977FD87 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977FD90 | 0x147B977FFB7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B977FFC0 | 0x147B97801BF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97803E0 | 0x147B978045F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9782740 | 0x147B978284F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9783980 | 0x147B9783AD7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97885B0 | 0x147B9788667 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B978AD30 | 0x147B978AE2F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B978B9F0 | 0x147B978BAF7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B978CBD0 | 0x147B978DDCF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B978E1E0 | 0x147B978E397 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B978EBD0 | 0x147B978FBCF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794040 | 0x147B97941F7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794200 | 0x147B97943B7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97943C0 | 0x147B9794577 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794580 | 0x147B9794737 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794740 | 0x147B97948F7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794900 | 0x147B9794AB7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794AC0 | 0x147B9794C77 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794C80 | 0x147B9794E37 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9794E40 | 0x147B9794FF7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795000 | 0x147B97951B7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97951C0 | 0x147B9795377 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795380 | 0x147B9795537 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795540 | 0x147B97956F7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795700 | 0x147B97958B7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97958C0 | 0x147B9795A77 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795AD0 | 0x147B9795C87 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795C90 | 0x147B9795E47 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9795E50 | 0x147B9796007 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9796010 | 0x147B97961C7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97961D0 | 0x147B9796387 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9796390 | 0x147B9796547 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9796550 | 0x147B9796707 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9796710 | 0x147B97968C7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9796E60 | 0x147B9797017 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9797AA0 | 0x147B9797C57 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9797E20 | 0x147B9797FD7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9797FE0 | 0x147B9798197 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9798AA0 | 0x147B9798E2F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9799650 | 0x147B9799747 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9799750 | 0x147B979988F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97998B0 | 0x147B97999A7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97999B0 | 0x147B9799AA7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9799AB0 | 0x147B9799BA7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9799BB0 | 0x147B9799CA7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B9799CB0 | 0x147B9799DA7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B979AED0 | 0x147B979B017 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B979B8E0 | 0x147B979BCDF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B979C100 | 0x147B97A0167 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97B0190 | 0x147B97B0357 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 4 | 0x147B97B0360 | 0x147B97B0487 | First Network Behavior |
|
64-bit | - |
|
|
| xmrig.exe | 4 | 0x7FF68A770000 | 0x7FF68B026FFF | First Network Behavior |
|
64-bit | 0x7FF68AB2AFB9 |
|
|
| xmrig.exe | 4 | 0x7FF68A770000 | 0x7FF68B026FFF | Final Dump |
|
64-bit | - |
|
|
| \\?\C:\Users\RDhJ0CNFevzX\Desktop\WinRing0x64.sys | Dropped File | Binary |
Clean
Known to be clean.
|
|
| Also Known As |
(Accessed File)
WinRing0x64.sys (Accessed File) |
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 14.20 KB |
| MD5 |
0c0195c48b6b8582fa6f6373032118da
|
| SHA1 |
d25340ae8e92a6d29f599fef426a2bc1b5217299
|
| SHA256 |
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
|
| SSDeep |
192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
|
| ImpHash |
d41fa95d4642dc981f10de36f4dc8cd7
|
| \\?\C:\Users\RDhJ0CNFevzX\Desktop\1.cmd | Dropped File | Text |
Clean
|
|
| Also Known As |
1.cmd (Accessed File)
C:\Users\RDhJ0CNFevzX\Desktop\1.cmd (Accessed File) |
| MIME Type | text/x-msdos-batch |
| File Size | 183 Bytes |
| MD5 |
25dd5e79a650043821b67f5acd70ff92
|
| SHA1 |
91ae7ca0f1f03ab364add8fed7b76b82c130405b
|
| SHA256 |
c0b8774d6bdb8fe949a1e03352f43f7725399171adbd12bd6d8557a9bfb2c9ad
|
| SSDeep |
3:mKDDVBF//IyXI7ghKTEQfhX0dcVLKaEndoFemPkgU7rKtIMInvuZv:hyEIJT5fhXvVLKlQemFU7Oavgv
|
| ImpHash | - |
| c:\users\rdhj0cnfevzx\desktop\__tmp_rar_sfx_access_check_20412546 | Dropped File | Empty |
Clean
|
|
| Also Known As |
__tmp_rar_sfx_access_check_20412546 (Accessed File, Dropped File)
|
| MIME Type | application/x-empty |
| File Size | 0 Bytes (not extracted) |
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SSDeep |
3::
|
| ImpHash | - |
| 6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994 | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\RDhJ0CNFevzX\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 15.36 KB |
| MD5 |
7b678b6cb96c363d9e0adc3a1b3b4893
|
| SHA1 |
c7e817672b686eb66bf5907da1efaef1dec8e06e
|
| SHA256 |
6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994
|
| SSDeep |
384:cCVOnt2MQzUHLz8NE/IEToowoF9VCN6eqiRYSSSSHDNMPi:wZuMv8EIETxryMZDN3
|
| ImpHash | - |
| 1027b3001f02a641e63f0f8890d8c241a96ad9f9b6f51ac18f1708e0b9b153e2 | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\RDhJ0CNFevzX\Desktop\xmrig.exe |
| MIME Type | image/png |
| File Size | 6.24 KB |
| MD5 |
d2b3b44dd5992d99b061cec9f87c5e3b
|
| SHA1 |
694991076e6bd92f29800d5f4fd4b136e9583a03
|
| SHA256 |
1027b3001f02a641e63f0f8890d8c241a96ad9f9b6f51ac18f1708e0b9b153e2
|
| SSDeep |
192:cpIADVqc29SUu1hqr2QTLpaNfnVWnvK4NhzC5Zaw4819E:cpBDEpIU8hqrtv4N4to5Zaw4819E
|
| ImpHash | - |
| 27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68 | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\RDhJ0CNFevzX\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 5.41 KB |
| MD5 |
e6ccfb6d9ffd4e1a907a47761c64bd79
|
| SHA1 |
d6a2994dedae3527a878140aa60dcaa087b90445
|
| SHA256 |
27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68
|
| SSDeep |
96:ioA0HldODFNSZCbgEZohRodU3vMg2vLWT3m5RQgVH0SmAMPzzZ2OC9vd/GrW4jD/:FlkDFNSWggWf3ILWTeMPzzZc9vd/yWe
|
| ImpHash | - |
| a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c | Extracted File | Image |
Clean
Known to be clean.
|
|
| Parent File | C:\Users\RDhJ0CNFevzX\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 2.81 KB |
| MD5 |
63486a769bbe3f49d5848b9c69734a25
|
| SHA1 |
e48bd36c2f23c238206bdddf3ebb6d6862905710
|
| SHA256 |
a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c
|
| SSDeep |
48:Tppthbcpv0j+3MIG68XIZm2iVAMd+1pzX7JGkVdxU6UPyoarDZICZXBIYB8bn0eP:7bev0j+3r0JCM8zb7JGkhU68yoanZHZc
|
| ImpHash | - |
