xmrig | 08e4ff0c3fd04510841e9f4e55ba0b3d2681d8f4c3405fd83dd9bbc4c2fa01d9

Analysis

max time kernel
148s
max time network
114s
platform
windows7_x64
resource
win7v20201028
submitted
07/12/2020, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
miner.exe
Size 5.5MB
Sample201207-jdsdnfheks
SHA256 08e4ff0c3fd04510841e9f4e55ba0b3d2681d8f4c3405fd83dd9bbc4c2fa01d9
MD5 1461c916cd8dc3c0acbbf3668c904580
SHA1 5a2fcbfe9811f238d72e966c8497bc893481daa5
SHA512 a82937e00faacb77ef221fdbaab5357bf3c89011b7e4b04fb8f8c55b8f4c394f4179b9945880b3340623ebf2389d8cf4e61e243333b960e702ccc3abbdcaeda6
MD5 SHA1 SHA512

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 5 IoCs

miner

resource	yara_rule
behavioral1/files/0x00030000000130ff-81.dat	xmrig
behavioral1/files/0x00030000000130ff-82.dat	xmrig
behavioral1/files/0x00030000000130ff-84.dat	xmrig
behavioral1/files/0x00030000000130ff-86.dat	xmrig
behavioral1/memory/1924-88-0x000000013FFD0000-0x00000001406EA000-memory.dmp	xmrig

Executes dropped EXE 9 IoCs

pid	Process
1928	d.exe
1668	ab.exe
904	d.exe
1664	ac.exe
1900	min.exe
1932	Start.exe
1500	svchost.exe
852	svchost.exe
1924	Windows Protection.exe

Loads dropped DLL 14 IoCs

pid	Process
1916	WScript.exe
1684	miner.exe
1684	miner.exe
1664	ac.exe
1664	ac.exe
1664	ac.exe
1664	ac.exe
1900	min.exe
1900	min.exe
1996	cmd.exe
1996	cmd.exe
1620	WScript.exe
2032	WScript.exe
1692	Process not Found

JavaScript code in executable 4 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130ff-81.dat	js
behavioral1/files/0x00030000000130ff-82.dat	js
behavioral1/files/0x00030000000130ff-84.dat	js
behavioral1/files/0x00030000000130ff-86.dat	js

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1468	schtasks.exe
1696	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1696	timeout.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeLockMemoryPrivilege	1924	Windows Protection.exe
Token: SeLockMemoryPrivilege	1924	Windows Protection.exe

Suspicious use of WriteProcessMemory 81 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1916	1684	miner.exe	26
PID 1684 wrote to memory of 1916	1684	miner.exe	26
PID 1684 wrote to memory of 1916	1684	miner.exe	26
PID 1684 wrote to memory of 1916	1684	miner.exe	26
PID 1916 wrote to memory of 1928	1916	WScript.exe	27
PID 1916 wrote to memory of 1928	1916	WScript.exe	27
PID 1916 wrote to memory of 1928	1916	WScript.exe	27
PID 1916 wrote to memory of 1928	1916	WScript.exe	27
PID 1916 wrote to memory of 2000	1916	WScript.exe	28
PID 1916 wrote to memory of 2000	1916	WScript.exe	28
PID 1916 wrote to memory of 2000	1916	WScript.exe	28
PID 1916 wrote to memory of 2000	1916	WScript.exe	28
PID 2000 wrote to memory of 1696	2000	cmd.exe	30
PID 2000 wrote to memory of 1696	2000	cmd.exe	30
PID 2000 wrote to memory of 1696	2000	cmd.exe	30
PID 2000 wrote to memory of 1696	2000	cmd.exe	30
PID 1684 wrote to memory of 1668	1684	miner.exe	34
PID 1684 wrote to memory of 1668	1684	miner.exe	34
PID 1684 wrote to memory of 1668	1684	miner.exe	34
PID 1684 wrote to memory of 1668	1684	miner.exe	34
PID 1668 wrote to memory of 1980	1668	ab.exe	35
PID 1668 wrote to memory of 1980	1668	ab.exe	35
PID 1668 wrote to memory of 1980	1668	ab.exe	35
PID 1668 wrote to memory of 1980	1668	ab.exe	35
PID 1980 wrote to memory of 904	1980	WScript.exe	36
PID 1980 wrote to memory of 904	1980	WScript.exe	36
PID 1980 wrote to memory of 904	1980	WScript.exe	36
PID 1980 wrote to memory of 904	1980	WScript.exe	36
PID 1980 wrote to memory of 928	1980	WScript.exe	37
PID 1980 wrote to memory of 928	1980	WScript.exe	37
PID 1980 wrote to memory of 928	1980	WScript.exe	37
PID 1980 wrote to memory of 928	1980	WScript.exe	37
PID 928 wrote to memory of 1468	928	cmd.exe	39
PID 928 wrote to memory of 1468	928	cmd.exe	39
PID 928 wrote to memory of 1468	928	cmd.exe	39
PID 928 wrote to memory of 1468	928	cmd.exe	39
PID 1684 wrote to memory of 1664	1684	miner.exe	40
PID 1684 wrote to memory of 1664	1684	miner.exe	40
PID 1684 wrote to memory of 1664	1684	miner.exe	40
PID 1684 wrote to memory of 1664	1684	miner.exe	40
PID 1664 wrote to memory of 1900	1664	ac.exe	41
PID 1664 wrote to memory of 1900	1664	ac.exe	41
PID 1664 wrote to memory of 1900	1664	ac.exe	41
PID 1664 wrote to memory of 1900	1664	ac.exe	41
PID 1900 wrote to memory of 1932	1900	min.exe	42
PID 1900 wrote to memory of 1932	1900	min.exe	42
PID 1900 wrote to memory of 1932	1900	min.exe	42
PID 1900 wrote to memory of 1932	1900	min.exe	42
PID 1932 wrote to memory of 1996	1932	Start.exe	43
PID 1932 wrote to memory of 1996	1932	Start.exe	43
PID 1932 wrote to memory of 1996	1932	Start.exe	43
PID 1996 wrote to memory of 1696	1996	cmd.exe	45
PID 1996 wrote to memory of 1696	1996	cmd.exe	45
PID 1996 wrote to memory of 1696	1996	cmd.exe	45
PID 1996 wrote to memory of 1620	1996	cmd.exe	46
PID 1996 wrote to memory of 1620	1996	cmd.exe	46
PID 1996 wrote to memory of 1620	1996	cmd.exe	46
PID 1996 wrote to memory of 1500	1996	cmd.exe	47
PID 1996 wrote to memory of 1500	1996	cmd.exe	47
PID 1996 wrote to memory of 1500	1996	cmd.exe	47
PID 1620 wrote to memory of 544	1620	WScript.exe	48
PID 1620 wrote to memory of 544	1620	WScript.exe	48
PID 1620 wrote to memory of 544	1620	WScript.exe	48
PID 1620 wrote to memory of 852	1620	WScript.exe	50
PID 1620 wrote to memory of 852	1620	WScript.exe	50
PID 1620 wrote to memory of 852	1620	WScript.exe	50
PID 544 wrote to memory of 1580	544	cmd.exe	51
PID 544 wrote to memory of 1580	544	cmd.exe	51
PID 544 wrote to memory of 1580	544	cmd.exe	51
PID 1580 wrote to memory of 1748	1580	powershell.exe	52
PID 1580 wrote to memory of 1748	1580	powershell.exe	52
PID 1580 wrote to memory of 1748	1580	powershell.exe	52
PID 1748 wrote to memory of 1908	1748	csc.exe	53
PID 1748 wrote to memory of 1908	1748	csc.exe	53
PID 1748 wrote to memory of 1908	1748	csc.exe	53
PID 1580 wrote to memory of 2032	1580	powershell.exe	54
PID 1580 wrote to memory of 2032	1580	powershell.exe	54
PID 1580 wrote to memory of 2032	1580	powershell.exe	54
PID 2032 wrote to memory of 1924	2032	WScript.exe	55
PID 2032 wrote to memory of 1924	2032	WScript.exe	55
PID 2032 wrote to memory of 1924	2032	WScript.exe	55

C:\Users\Admin\AppData\Local\Temp\miner.exe
"C:\Users\Admin\AppData\Local\Temp\miner.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\d.vbs"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\ProgramData\Defender\d.exe
    "C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\d.bat
    3⤵
    - Executes dropped EXE
    PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ProgramData\Defender\t.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1696
- C:\ProgramData\Defender\ab.exe
  C:\ProgramData\Defender\ab.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\dd.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\ProgramData\Defender\d.exe
      "C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\dd.bat
      4⤵
      Executes dropped EXE
      PID:904
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\ProgramData\Defender\t.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:928
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:1468
- C:\ProgramData\Defender\ac.exe
  C:\ProgramData\Defender\ac.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\ProgramData\Defender\min.exe
    "C:\ProgramData\Defender\min.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\ProgramData\Defender\Start.exe
      C:\ProgramData\Defender\Start.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B71F.tmp\B720.tmp\B731.bat C:\ProgramData\Defender\Start.exe"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:1696
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\s.vbs"
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\System32\cmd.exe
        
        cmd /c ""C:\ProgramData\Defender\s.bat" "
        7⤵
        
        PID:544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -executionpolicy Unrestricted C:\ProgramData\Defender\timeout.ps1
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iyruljr3\iyruljr3.cmdline"
        9⤵
        
        PID:1748
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF40F.tmp" "c:\Users\Admin\AppData\Local\Temp\iyruljr3\CSCF445AB75ED341D89DA8D59EB695F641.TMP"
        10⤵
        
        PID:1908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\p.vbs"
        9⤵
        Loads dropped DLL
        
        PID:2032
        
        C:\ProgramData\Defender\Windows Protection.exe
        
        "C:\ProgramData\Defender\Windows Protection.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\ProgramData\Task Host\svchost.exe
        
        "C:\ProgramData\Task Host\svchost.exe"
        7⤵
        Executes dropped EXE
        
        PID:852
      - C:\ProgramData\Task Host\svchost.exe
        
        "C:\ProgramData\Task Host\svchost.exe"
        6⤵
        Executes dropped EXE
        
        PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-78-0x000000001C120000-0x000000001C121000-memory.dmp

Download

memory/1580-64-0x0000000002450000-0x0000000002451000-memory.dmp

Download

memory/1580-65-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/1580-77-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/1580-69-0x000000001C610000-0x000000001C611000-memory.dmp

Download

memory/1580-61-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmp

Download

memory/1580-62-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/1580-63-0x000000001AAC0000-0x000000001AAC1000-memory.dmp

Download

memory/1580-68-0x000000001C280000-0x000000001C284000-memory.dmp

Download

memory/1580-67-0x000000001C280000-0x000000001C284000-memory.dmp

Download

memory/1620-59-0x00000000024A0000-0x00000000024A4000-memory.dmp

Download

memory/1668-16-0x0000000001060000-0x0000000001161000-memory.dmp

Download

memory/1916-10-0x0000000002690000-0x0000000002694000-memory.dmp

Download

memory/1924-88-0x000000013FFD0000-0x00000001406EA000-memory.dmp

Download

memory/1932-42-0x0000000140000000-0x0000000140023000-memory.dmp

Download

memory/1980-23-0x00000000026B0000-0x00000000026B4000-memory.dmp

Download

memory/2032-85-0x0000000002650000-0x0000000002654000-memory.dmp

Download