Dynamic Analysis Report
Created on 2024-10-01T19:34:27+00:00
OKLA.exe
Windows Exe (x86-32)
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "3 minutes" to "10 seconds" to reveal dormant functionality.
Remarks
(0x0200004A): 1 dump(s) were skipped because they exceeded the maximum dump size of 16 MB. The largest one was 256 MB.
| Filters: |
There are no files for this filter
There are no files in this analysis
| File Name | Category | Type | Verdict | Actions |
|---|
| C:\Users\OqXZRaykm\Desktop\OKLA.exe | Sample File | Binary |
Malicious
|
|
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 2.40 MB |
| MD5 |
31e8fd45be874bc61e8a196ff863bfdc
|
| SHA1 |
11c210f1d30dafc5fa552b119dadf3785c655b78
|
| SHA256 |
447ab2a925fbab2c9474d9a1f5d89a94c871faf78ec9281255cfe1bdc0fd7e64
|
| SSDeep |
49152:nILLyvOacuT9fbDxw6++uxp+NqiurJoP6rZ0B1qxtVujoiJ67XoifXUGOOnx:nxzfaJ+uxp+8rZ9t8JQfEQx
|
| ImpHash |
0ae9e38912ff6bd742a1b9e5c003576a
|
Memory Dumps (2)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| okla.exe | 1 | 0x004A0000 | 0x00516FFF | Relevant Image |
|
32-bit | 0x004C3BEE |
|
|
| okla.exe | 1 | 0x004A0000 | 0x00516FFF | Process Termination |
|
32-bit | - |
|
|
| \\?\C:\Users\OqXZRaykm\Desktop\xmrig.exe | Dropped File | Binary |
Malicious
|
|
| Also Known As |
C:\Users\OqXZRaykm\Desktop\xmrig.exe (Accessed File)
xmrig.exe (Accessed File) |
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 6.06 MB |
| MD5 |
5fba8ae226b096da3b31de0e17496735
|
| SHA1 |
d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
|
| SHA256 |
ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
|
| SSDeep |
98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
|
| ImpHash |
12806e48b853545b536463546db4baa1
|
Memory Dumps (39)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| xmrig.exe | 7 | 0x7FF770FC0000 | 0x7FF771876FFF | Relevant Image |
|
64-bit | 0x7FF7713D38E0 |
|
|
| buffer | 7 | 0x001D0000 | 0x001EFFFF | Content Changed |
|
64-bit | - |
|
|
| buffer | 7 | 0x0014C000 | 0x0014FFFF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x001D0000 | 0x001EFFFF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00570750 | 0x00570824 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x005777A0 | 0x0057781F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00577A60 | 0x00577B55 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00577B90 | 0x00577C0F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00579850 | 0x005798D5 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00579F30 | 0x0057A027 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0057A320 | 0x0057A39F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0057A5E0 | 0x0057A737 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0057DB40 | 0x0057DBBF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0057EF60 | 0x0057F15F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0057F2A0 | 0x0057F397 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0057F4E0 | 0x0057F707 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00580A20 | 0x00580DE7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00580DF0 | 0x00580F47 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0058FC80 | 0x0058FD7F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x00591CB0 | 0x00592EAF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x005952E0 | 0x005962DF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059F6A0 | 0x0059F7AF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059F7C0 | 0x0059FB4F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059FB60 | 0x0059FC57 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059FC60 | 0x0059FD9F | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059FDC0 | 0x0059FEB7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059FEC0 | 0x0059FFB7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x0059FFC0 | 0x005A00B7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x005A10D0 | 0x005A11C7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x005A11D0 | 0x005A12C7 | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x005A2460 | 0x005A24DF | First Network Behavior |
|
64-bit | - |
|
|
| buffer | 7 | 0x005A24F0 | 0x005A28EF | First Network Behavior |
|
64-bit | - |
|
|
| xmrig.exe | 7 | 0x7FF770FC0000 | 0x7FF771876FFF | First Network Behavior |
|
64-bit | 0x7FF77137B000 |
|
|
| buffer | 7 | 0x00550000 | 0x0056FFFF | First Execution |
|
64-bit | 0x00550EC0 |
|
|
| buffer | 7 | 0x00550000 | 0x0056FFFF | Content Changed |
|
64-bit | 0x00551030 |
|
|
| buffer | 7 | 0x00550000 | 0x0056FFFF | Content Changed |
|
64-bit | 0x0055AC18 |
|
|
| buffer | 7 | 0x00550000 | 0x0056FFFF | Content Changed |
|
64-bit | 0x0055C000 |
|
|
| buffer | 7 | 0x00550000 | 0x0056FFFF | Content Changed |
|
64-bit | 0x005598E8 |
|
|
| buffer | 7 | 0x00550000 | 0x0056FFFF | Content Changed |
|
64-bit | 0x0055B000 |
|
|
| \\?\C:\Users\OqXZRaykm\Desktop\WinRing0x64.sys | Dropped File | Binary |
Clean
Known to be clean.
|
|
| Also Known As |
(Accessed File)
WinRing0x64.sys (Accessed File) |
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 14.20 KB |
| MD5 |
0c0195c48b6b8582fa6f6373032118da
|
| SHA1 |
d25340ae8e92a6d29f599fef426a2bc1b5217299
|
| SHA256 |
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
|
| SSDeep |
192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
|
| ImpHash |
d41fa95d4642dc981f10de36f4dc8cd7
|
| c:\windows\system32\winevt\logs\system.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.06 MB |
| MD5 |
6db1f0210b0f887fdc7842c6b3adcf56
|
| SHA1 |
fa87212e9bdb19f6e2e2fed6fcf7581cc3725a0d
|
| SHA256 |
f0ed60649e4f68337e820d08bc532b6c4e5a78184c5e7b2e3616a28c7e3d2863
|
| SSDeep |
1536:8kW/blLiCyjIr+76fSmacynEGxWZhRbd6a/wXh2S9qjKpaOt7xx6KtuKVmflXF9O:8kkblLiCyEprL/WzNxclrSXjF50
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\application.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.06 MB |
| MD5 |
e9185ff6727e2649b11091bd5cbdcbe5
|
| SHA1 |
0180e0c30ea016529dacad215630b063da5b6e60
|
| SHA256 |
d459f7a167818872d77d2647896c7a18ad3c9dd5a20a142829babec9191809dc
|
| SSDeep |
3072:0z6/3lAzcocqcmL/olxcNcyVcFmMcKcNcViGBcTcccgM8cpcx0RPTh5aKaxcpcu3:0/olweaKau
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-wmi-activity%4operational.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 1.00 MB |
| MD5 |
596b81fada2a2b7b79ae85621dda500c
|
| SHA1 |
060fe8d0153f798cf3681f0cdb3e59319178bc2b
|
| SHA256 |
26a0f52393edd8a53c8652e29ebeb2d333ce47181fb1a5ae5e1703d62debab09
|
| SSDeep |
384:B3h4RFRRObx3RurDRkmR51RdRjRxRSzvRhRnR9x6RgRqYRZxRRRaR7RDRLRWRaRu:lthlhziooz1gLNjWKLZWOa1
|
| ImpHash | - |
| c:\windows\system32\perfstringbackup.ini | Dropped File | Stream |
Clean
|
|
| Also Known As |
c:\windows\system32\perfstringbackup.tmp (Dropped File)
|
| MIME Type | application/octet-stream |
| File Size | 777.08 KB |
| MD5 |
4dd537f1ea92c248c3ee76e94eeaa7de
|
| SHA1 |
d5a1afdd6e856fc15d54f09509544cc2148f503d
|
| SHA256 |
34d047689cb731eead66c75e1daf1f2e0c6fd68155dd53dfd4fc352c39a4aa81
|
| SSDeep |
3072:NJQGb/6IPolY/OhyIGmZkzTMWcnqgspmTbQiIJEDc3dv+eBrq2Bw+1wQ5xcEkc76:A1nqgsp2gOKihb
|
| ImpHash | - |
| c:\windows\logs\cbs\cbs.log | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 255.82 KB |
| MD5 |
ea4e9132af5c8018db7529100ce1fcad
|
| SHA1 |
12468e0997e3b7a740e779be448203db358b0aff
|
| SHA256 |
c88229f42c5176c97053d1adbf3c5bd0145e5fbb6c81733ffa7a74689796fe25
|
| SSDeep |
384:RwVe3S5+VQSmzVeO5PBgzM5+sx7ruvr8uI4JvDQRo3nTVrk9H:RGei5+VnmzVeOvgzM5+sx8VQRo3nTV
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-security-spp-ux-notifications%4actioncenter.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 68.00 KB |
| MD5 |
0d245944ca08a461b8ec85bb22009b2d
|
| SHA1 |
972609acd3e1b30d442fd93e654bb861f4b6d96d
|
| SHA256 |
98bcffe93b789943fae880cf125e6f7657359bbc5154bf326aed19f0e8dfca0f
|
| SSDeep |
384:2whzqiZ7iZuiZyiZeiZwiZ1iZPiZuiZ6iZ3iZHiZ3iZ+iZkiZgiZtiZuiZ7iZziD:jDwVRFnaMVpk0klzXCVwYc8gxZkWWVv
|
| ImpHash | - |
| c:\windows\system32\winevt\logs\microsoft-windows-taskscheduler%4maintenance.evtx | Dropped File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 68.00 KB |
| MD5 |
4b8e4613bdf95024d7a6f043bcd04052
|
| SHA1 |
9edcd0d3feb07b16822cf5f77a80c0d67603949d
|
| SHA256 |
852dad98d4dac2ab0fda77551222d537cded42868797deb497f8d0310ed52c28
|
| SSDeep |
1536:cKCKAKsKjKJK3KYKVKMKyKCK8KiK0K4K8KiKPKBKYKNjmKWKdKPKdKSK6KbK1Kbm:cKCKAKsKjKJK3KYKVKMKyKCK8KiK0K4g
|
| ImpHash | - |
| c:\windows\inf\wmiaprpl\wmiaprpl.ini | Dropped File | Text |
Clean
Known to be clean.
|
|
| Also Known As |
c:\windows\system32\wbem\performance\wmiaprpl.ini (Dropped File)
c:\windows\system32\wbem\performance\wmiaprpl_new.ini (Dropped File) |
| MIME Type | text/plain |
| File Size | 29.03 KB |
| MD5 |
ffdeea82ba4a5a65585103dd2a922dfe
|
| SHA1 |
094c3794503245cc7dfa9e222d3504f449a5400b
|
| SHA256 |
c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
|
| SSDeep |
384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
|
| ImpHash | - |
| c:\windows\inf\wmiaprpl\wmiaprpl.h | Dropped File | Text |
Clean
Known to be clean.
|
|
| MIME Type | text/plain |
| File Size | 3.36 KB |
| MD5 |
b133a676d139032a27de3d9619e70091
|
| SHA1 |
1248aa89938a13640252a79113930ede2f26f1fa
|
| SHA256 |
ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
|
| SSDeep |
48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
|
| ImpHash | - |
| C:\Users\OqXZRaykm\Desktop\1.cmd | Dropped File | Text |
Clean
|
|
| Also Known As |
1.cmd (Accessed File)
\\?\C:\Users\OqXZRaykm\Desktop\1.cmd (Accessed File) |
| MIME Type | text/x-msdos-batch |
| File Size | 183 Bytes |
| MD5 |
25dd5e79a650043821b67f5acd70ff92
|
| SHA1 |
91ae7ca0f1f03ab364add8fed7b76b82c130405b
|
| SHA256 |
c0b8774d6bdb8fe949a1e03352f43f7725399171adbd12bd6d8557a9bfb2c9ad
|
| SSDeep |
3:mKDDVBF//IyXI7ghKTEQfhX0dcVLKaEndoFemPkgU7rKtIMInvuZv:hyEIJT5fhXvVLKlQemFU7Oavgv
|
| ImpHash | - |
| c:\users\oqxzraykm\desktop\__tmp_rar_sfx_access_check_31581859 | Dropped File | Empty |
Clean
|
|
| Also Known As |
__tmp_rar_sfx_access_check_31581859 (Accessed File, Dropped File)
|
| MIME Type | application/x-empty |
| File Size | 0 Bytes (not extracted) |
| MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
| SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
| SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
| SSDeep |
3::
|
| ImpHash | - |
| c:\windows\system32\perfh009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 659.38 KB |
| MD5 |
c146afddee532240a480e79429e42d4c
|
| SHA1 |
1e1ffe476cf77929da882bdff7ce417c6771b5ba
|
| SHA256 |
b072e19af57494727c1fa78e2e6bd8fea07567b6d570fb1fba52e311736b5779
|
| SSDeep |
3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRa:78M6d0w+WB6X
|
| ImpHash | - |
| c:\windows\system32\perfh009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 646.33 KB |
| MD5 |
e40274085a7456e341b393828a83a204
|
| SHA1 |
b37899dbd6dc8da64b8ceb2afee684ee4471317c
|
| SHA256 |
a4bbd4981bf03910e2a7ab2e87bd8b3415afbf371b56dd04ead9a4e6d9e10668
|
| SSDeep |
3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRJ:78M6d0w+WB6Q
|
| ImpHash | - |
| c:\windows\system32\perfc009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 122.47 KB |
| MD5 |
a1c55f2a9c41899549af8593bf5e4ce7
|
| SHA1 |
d8d4ca6afedc87e1bec3f819dba897095b6fea8e
|
| SHA256 |
a57660cb5ec3beec908ee2fb8cbafded9afb23bd91d0273ccf31f17fe206ef1f
|
| SSDeep |
3072:XBnfw8ld9+mRDaUR28oV7TY+7S0bCDhUHL:c
|
| ImpHash | - |
| c:\windows\system32\perfc009.dat | Modified File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 118.55 KB |
| MD5 |
ba6c49f98e2451a28974da13c598d0ea
|
| SHA1 |
de82a1fcdd6b98c421a9cf36f4eb9dde6fe26859
|
| SHA256 |
5d8988f2bcf7284cd96510e6735d7be5371103a83c85d04168d01f793becc960
|
| SSDeep |
1536:X1i4nfw8ld9+mRDaUR28oV7TYfXLi7NwrgSwQ:XBnfw8ld9+mRDaUR28oV7TY+7S0bQ
|
| ImpHash | - |
| c:\windows\system32\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask | Modified File | Text |
Clean
|
|
| MIME Type | text/xml |
| File Size | 4.57 KB |
| MD5 |
ff11a3b4ae7edea210dc4c050831ff8c
|
| SHA1 |
30d5d7762cf2e0284d4948684c60afebaca22887
|
| SHA256 |
dc7855e1df3e5f606c9eb1531429f9a194c9300ea7cea60bf7231f547cf48e0f
|
| SSDeep |
96:pYMguQII4iF6h4aGdinipV9ll7UY5HAmzQ+:9A4N/xne7HO+
|
| ImpHash | - |
| 6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994 | Extracted File | Image |
Clean
Known to be clean.
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 15.36 KB |
| MD5 |
7b678b6cb96c363d9e0adc3a1b3b4893
|
| SHA1 |
c7e817672b686eb66bf5907da1efaef1dec8e06e
|
| SHA256 |
6f86849b026f0c45c0c8a1145048960bbdefdaea3beac030f114b1ff16057994
|
| SSDeep |
384:cCVOnt2MQzUHLz8NE/IEToowoF9VCN6eqiRYSSSSHDNMPi:wZuMv8EIETxryMZDN3
|
| ImpHash | - |
| 1027b3001f02a641e63f0f8890d8c241a96ad9f9b6f51ac18f1708e0b9b153e2 | Extracted File | Image |
Clean
|
|
| Parent File | \\?\C:\Users\OqXZRaykm\Desktop\xmrig.exe |
| MIME Type | image/png |
| File Size | 6.24 KB |
| MD5 |
d2b3b44dd5992d99b061cec9f87c5e3b
|
| SHA1 |
694991076e6bd92f29800d5f4fd4b136e9583a03
|
| SHA256 |
1027b3001f02a641e63f0f8890d8c241a96ad9f9b6f51ac18f1708e0b9b153e2
|
| SSDeep |
192:cpIADVqc29SUu1hqr2QTLpaNfnVWnvK4NhzC5Zaw4819E:cpBDEpIU8hqrtv4N4to5Zaw4819E
|
| ImpHash | - |
| 27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68 | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 5.41 KB |
| MD5 |
e6ccfb6d9ffd4e1a907a47761c64bd79
|
| SHA1 |
d6a2994dedae3527a878140aa60dcaa087b90445
|
| SHA256 |
27d3a1a2da49dc535cc10806abaae9dfa49e4f5f44a40540ead50e065b99ca68
|
| SSDeep |
96:ioA0HldODFNSZCbgEZohRodU3vMg2vLWT3m5RQgVH0SmAMPzzZ2OC9vd/GrW4jD/:FlkDFNSWggWf3ILWTeMPzzZc9vd/yWe
|
| ImpHash | - |
| a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\OKLA.exe |
| MIME Type | image/png |
| File Size | 2.81 KB |
| MD5 |
63486a769bbe3f49d5848b9c69734a25
|
| SHA1 |
e48bd36c2f23c238206bdddf3ebb6d6862905710
|
| SHA256 |
a91f4373ceebadfc70b3bd0758848918f928c3c76562e3d9d531574796fd9e9c
|
| SSDeep |
48:Tppthbcpv0j+3MIG68XIZm2iVAMd+1pzX7JGkVdxU6UPyoarDZICZXBIYB8bn0eP:7bev0j+3r0JCM8zb7JGkhU68yoanZHZc
|
| ImpHash | - |
