xmrig | 46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
151s
max time network
164s
platform
windows10_x64
resource
win10
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/a2981192a30538e97b55f363abbce946.exe

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 3 IoCs

Processes:

84.exeseser.exeseser.exe

pid process

876 84.exe
1160 seser.exe
1364 seser.exe
Drops file in System32 directory 2 IoCs

Processes:

84.exe

description ioc process

File created C:\Windows\SysWOW64\seser.exe 84.exe
File opened for modification C:\Windows\SysWOW64\seser.exe 84.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

84.exe

description pid process

Token: SeIncBasePriorityPrivilege 876 84.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a2981192a30538e97b55f363abbce946.exe

pid process

8 a2981192a30538e97b55f363abbce946.exe
8 a2981192a30538e97b55f363abbce946.exe

pid	process
876	84.exe
1160	seser.exe
1364	seser.exe

description	ioc	process
File created	C:\Windows\SysWOW64\seser.exe	84.exe
File opened for modification	C:\Windows\SysWOW64\seser.exe	84.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	876	84.exe

pid	process
8	a2981192a30538e97b55f363abbce946.exe
8	a2981192a30538e97b55f363abbce946.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a2981192a30538e97b55f363abbce946.exeseser.exe84.exe

description	pid	process	target process
PID 8 wrote to memory of 876	8	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 8 wrote to memory of 876	8	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 8 wrote to memory of 876	8	a2981192a30538e97b55f363abbce946.exe	84.exe
PID 1160 wrote to memory of 1364	1160	seser.exe	seser.exe
PID 1160 wrote to memory of 1364	1160	seser.exe	seser.exe
PID 1160 wrote to memory of 1364	1160	seser.exe	seser.exe
PID 876 wrote to memory of 1660	876	84.exe	cmd.exe
PID 876 wrote to memory of 1660	876	84.exe	cmd.exe
PID 876 wrote to memory of 1660	876	84.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\foo\a2981192a30538e97b55f363abbce946.exe
"C:\Users\Admin\AppData\Local\Temp\foo\a2981192a30538e97b55f363abbce946.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8

C:\Users\Admin\AppData\Local\Temp\foo\84.exe
C:\Users\Admin\AppData\Local\Temp\foo\84.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\foo\84.exe > nul
3⤵
PID:1660

C:\Windows\SysWOW64\seser.exe
C:\Windows\SysWOW64\seser.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\seser.exe
C:\Windows\SysWOW64\seser.exe Win7
2⤵
- Executes dropped EXE
PID:1364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\foo\84.exe
MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Users\Admin\AppData\Local\Temp\foo\84.exe
MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Windows\SysWOW64\seser.exe
MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Windows\SysWOW64\seser.exe
MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
C:\Windows\SysWOW64\seser.exe
MD5
78c317b9d69241405a3340e6821d7870

SHA1
5555ade999d4871795c90017770ded18257cd643

SHA256
c4286e7b0cd927a2263d5bbaa47d0ce473c4ddfecf83327900c9c3f20c4f5f2e

SHA512
eb0e1a440fc2c237385c000b9e2299938cad2e300078ee9ee8f941d222778d00e6048d0b9d89bd937351c1129a697a19df5899944735478561b784074d27166d

Download Submit
memory/876-0-0x0000000000000000-mapping.dmp

Download
memory/876-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1160-6-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1364-7-0x0000000000000000-mapping.dmp

Download
memory/1660-9-0x0000000000000000-mapping.dmp

Download