xmrig | 46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
151s
max time network
170s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/a2981192a30538e97b55f363abbce946.exe

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 3 IoCs

pid	Process
1648	84.exe
1652	seser.exe
2000	seser.exe

Loads dropped DLL 4 IoCs

pid	Process
1552	a2981192a30538e97b55f363abbce946.exe
1552	a2981192a30538e97b55f363abbce946.exe
1964	WerFault.exe
1964	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\seser.exe	84.exe
File created	C:\Windows\SysWOW64\seser.exe	84.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1652	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1648	84.exe
Token: SeDebugPrivilege	1964	WerFault.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1552	a2981192a30538e97b55f363abbce946.exe
1552	a2981192a30538e97b55f363abbce946.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	28
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	28
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	28
PID 1552 wrote to memory of 1648	1552	a2981192a30538e97b55f363abbce946.exe	28
PID 1652 wrote to memory of 2000	1652	seser.exe	30
PID 1652 wrote to memory of 2000	1652	seser.exe	30
PID 1652 wrote to memory of 2000	1652	seser.exe	30
PID 1652 wrote to memory of 2000	1652	seser.exe	30
PID 1652 wrote to memory of 1964	1652	seser.exe	31
PID 1652 wrote to memory of 1964	1652	seser.exe	31
PID 1652 wrote to memory of 1964	1652	seser.exe	31
PID 1652 wrote to memory of 1964	1652	seser.exe	31
PID 1648 wrote to memory of 1948	1648	84.exe	32
PID 1648 wrote to memory of 1948	1648	84.exe	32
PID 1648 wrote to memory of 1948	1648	84.exe	32
PID 1648 wrote to memory of 1948	1648	84.exe	32

C:\Users\Admin\AppData\Local\Temp\foo\a2981192a30538e97b55f363abbce946.exe
"C:\Users\Admin\AppData\Local\Temp\foo\a2981192a30538e97b55f363abbce946.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\foo\84.exe
  C:\Users\Admin\AppData\Local\Temp\foo\84.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\foo\84.exe > nul
    3⤵
    PID:1948

C:\Windows\SysWOW64\seser.exe
C:\Windows\SysWOW64\seser.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\seser.exe
  C:\Windows\SysWOW64\seser.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 256
  2⤵
  - Loads dropped DLL
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-0-0x000007FEF7E20000-0x000007FEF809A000-memory.dmp

Filesize
2.5MB

Download
memory/1648-5-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1964-13-0x0000000001C40000-0x0000000001C51000-memory.dmp

Filesize
68KB

Download
memory/1964-17-0x0000000002380000-0x0000000002391000-memory.dmp

Filesize
68KB

Download
memory/2000-18-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download