xmrig | 46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
151s
max time network
170s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/a2981192a30538e97b55f363abbce946.exe

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 3 IoCs

Processes:

84.exeseser.exeseser.exe

pid process

1648 84.exe
1652 seser.exe
2000 seser.exe
Loads dropped DLL 4 IoCs

Processes:

a2981192a30538e97b55f363abbce946.exeWerFault.exe

pid process

1552 a2981192a30538e97b55f363abbce946.exe
1552 a2981192a30538e97b55f363abbce946.exe
1964 WerFault.exe
1964 WerFault.exe
Drops file in System32 directory 2 IoCs

Processes:

84.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\seser.exe 84.exe
File created C:\Windows\SysWOW64\seser.exe 84.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 1652 WerFault.exe seser.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1964 WerFault.exe
1964 WerFault.exe
1964 WerFault.exe
1964 WerFault.exe
1964 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

84.exeWerFault.exe

description pid process

Token: SeIncBasePriorityPrivilege 1648 84.exe
Token: SeDebugPrivilege 1964 WerFault.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a2981192a30538e97b55f363abbce946.exe

pid process

1552 a2981192a30538e97b55f363abbce946.exe
1552 a2981192a30538e97b55f363abbce946.exe

pid	process
1648	84.exe
1652	seser.exe
2000	seser.exe

pid	process
1552	a2981192a30538e97b55f363abbce946.exe
1552	a2981192a30538e97b55f363abbce946.exe
1964	WerFault.exe
1964	WerFault.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\seser.exe	84.exe
File created	C:\Windows\SysWOW64\seser.exe	84.exe

pid	pid_target	process	target process
1964	1652	WerFault.exe	seser.exe

pid	process
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1648	84.exe
Token: SeDebugPrivilege	1964	WerFault.exe

pid	process
1552	a2981192a30538e97b55f363abbce946.exe
1552	a2981192a30538e97b55f363abbce946.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a2981192a30538e97b55f363abbce946.exeseser.exe84.exe

description	pid	process	target process
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 1652 wrote to memory of 2000	1652	seser.exe	seser.exe
PID 1652 wrote to memory of 2000	1652	seser.exe	seser.exe
PID 1652 wrote to memory of 2000	1652	seser.exe	seser.exe
PID 1652 wrote to memory of 2000	1652	seser.exe	seser.exe
PID 1652 wrote to memory of 1964	1652	seser.exe	WerFault.exe
PID 1652 wrote to memory of 1964	1652	seser.exe	WerFault.exe
PID 1652 wrote to memory of 1964	1652	seser.exe	WerFault.exe
PID 1652 wrote to memory of 1964	1652	seser.exe	WerFault.exe
PID 1648 wrote to memory of 1948	1648	84.exe	cmd.exe
PID 1648 wrote to memory of 1948	1648	84.exe	cmd.exe
PID 1648 wrote to memory of 1948	1648	84.exe	cmd.exe
PID 1648 wrote to memory of 1948	1648	84.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\foo\a2981192a30538e97b55f363abbce946.exe
"C:\Users\Admin\AppData\Local\Temp\foo\a2981192a30538e97b55f363abbce946.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\foo\84.exe
  C:\Users\Admin\AppData\Local\Temp\foo\84.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\foo\84.exe > nul
    3⤵
    PID:1948

C:\Windows\SysWOW64\seser.exe
C:\Windows\SysWOW64\seser.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\seser.exe
  C:\Windows\SysWOW64\seser.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 256
  2⤵
  - Loads dropped DLL
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\foo\84.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Users\Admin\AppData\Local\Temp\foo\84.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Windows\SysWOW64\seser.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Windows\SysWOW64\seser.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Windows\SysWOW64\seser.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
\Users\Admin\AppData\Local\Temp\foo\84.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
\Users\Admin\AppData\Local\Temp\foo\84.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
\Windows\SysWOW64\seser.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
\Windows\SysWOW64\seser.exe

MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
memory/1032-0-0x000007FEF7E20000-0x000007FEF809A000-memory.dmp

Filesize
2.5MB

Download
memory/1648-5-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1648-3-0x0000000000000000-mapping.dmp

Download
memory/1948-16-0x0000000000000000-mapping.dmp

Download
memory/1964-12-0x0000000000000000-mapping.dmp

Download
memory/1964-13-0x0000000001C40000-0x0000000001C51000-memory.dmp

Filesize
68KB

Download
memory/1964-17-0x0000000002380000-0x0000000002391000-memory.dmp

Filesize
68KB

Download
memory/2000-10-0x0000000000000000-mapping.dmp

Download
memory/2000-18-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download