xmrig | 08e4ff0c3fd04510841e9f4e55ba0b3d2681d8f4c3405fd83dd9bbc4c2fa01d9

Analysis

max time kernel
149s
max time network
109s
platform
windows10_x64
resource
win10v20201028
submitted
07/12/2020, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
miner.exe
Size 5.5MB
Sample201207-jdsdnfheks
SHA256 08e4ff0c3fd04510841e9f4e55ba0b3d2681d8f4c3405fd83dd9bbc4c2fa01d9
MD5 1461c916cd8dc3c0acbbf3668c904580
SHA1 5a2fcbfe9811f238d72e966c8497bc893481daa5
SHA512 a82937e00faacb77ef221fdbaab5357bf3c89011b7e4b04fb8f8c55b8f4c394f4179b9945880b3340623ebf2389d8cf4e61e243333b960e702ccc3abbdcaeda6
MD5 SHA1 SHA512

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

resource	yara_rule
behavioral2/files/0x000100000001ab6e-61.dat	xmrig
behavioral2/files/0x000100000001ab6e-63.dat	xmrig
behavioral2/memory/3848-65-0x00007FF720170000-0x00007FF72088A000-memory.dmp	xmrig

Executes dropped EXE 9 IoCs

pid	Process
60	d.exe
3804	ab.exe
2744	d.exe
3700	ac.exe
2548	min.exe
884	Start.exe
2808	svchost.exe
3996	svchost.exe
3848	Windows Protection.exe

JavaScript code in executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab6e-61.dat	js
behavioral2/files/0x000100000001ab6e-63.dat	js

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3172	schtasks.exe
4004	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2052	timeout.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	miner.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	ab.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeLockMemoryPrivilege	3848	Windows Protection.exe
Token: SeLockMemoryPrivilege	3848	Windows Protection.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1496	1176	miner.exe	75
PID 1176 wrote to memory of 1496	1176	miner.exe	75
PID 1176 wrote to memory of 1496	1176	miner.exe	75
PID 1496 wrote to memory of 60	1496	WScript.exe	77
PID 1496 wrote to memory of 60	1496	WScript.exe	77
PID 1496 wrote to memory of 1036	1496	WScript.exe	78
PID 1496 wrote to memory of 1036	1496	WScript.exe	78
PID 1496 wrote to memory of 1036	1496	WScript.exe	78
PID 1036 wrote to memory of 3172	1036	cmd.exe	80
PID 1036 wrote to memory of 3172	1036	cmd.exe	80
PID 1036 wrote to memory of 3172	1036	cmd.exe	80
PID 1176 wrote to memory of 3804	1176	miner.exe	84
PID 1176 wrote to memory of 3804	1176	miner.exe	84
PID 1176 wrote to memory of 3804	1176	miner.exe	84
PID 3804 wrote to memory of 2500	3804	ab.exe	85
PID 3804 wrote to memory of 2500	3804	ab.exe	85
PID 3804 wrote to memory of 2500	3804	ab.exe	85
PID 2500 wrote to memory of 2744	2500	WScript.exe	86
PID 2500 wrote to memory of 2744	2500	WScript.exe	86
PID 2500 wrote to memory of 1088	2500	WScript.exe	87
PID 2500 wrote to memory of 1088	2500	WScript.exe	87
PID 2500 wrote to memory of 1088	2500	WScript.exe	87
PID 1088 wrote to memory of 4004	1088	cmd.exe	89
PID 1088 wrote to memory of 4004	1088	cmd.exe	89
PID 1088 wrote to memory of 4004	1088	cmd.exe	89
PID 1176 wrote to memory of 3700	1176	miner.exe	90
PID 1176 wrote to memory of 3700	1176	miner.exe	90
PID 1176 wrote to memory of 3700	1176	miner.exe	90
PID 3700 wrote to memory of 2548	3700	ac.exe	91
PID 3700 wrote to memory of 2548	3700	ac.exe	91
PID 3700 wrote to memory of 2548	3700	ac.exe	91
PID 2548 wrote to memory of 884	2548	min.exe	93
PID 2548 wrote to memory of 884	2548	min.exe	93
PID 884 wrote to memory of 3428	884	Start.exe	94
PID 884 wrote to memory of 3428	884	Start.exe	94
PID 3428 wrote to memory of 2052	3428	cmd.exe	96
PID 3428 wrote to memory of 2052	3428	cmd.exe	96
PID 3428 wrote to memory of 3728	3428	cmd.exe	97
PID 3428 wrote to memory of 3728	3428	cmd.exe	97
PID 3428 wrote to memory of 2808	3428	cmd.exe	98
PID 3428 wrote to memory of 2808	3428	cmd.exe	98
PID 3728 wrote to memory of 388	3728	WScript.exe	99
PID 3728 wrote to memory of 388	3728	WScript.exe	99
PID 3728 wrote to memory of 3996	3728	WScript.exe	101
PID 3728 wrote to memory of 3996	3728	WScript.exe	101
PID 388 wrote to memory of 1628	388	cmd.exe	102
PID 388 wrote to memory of 1628	388	cmd.exe	102
PID 1628 wrote to memory of 2160	1628	powershell.exe	103
PID 1628 wrote to memory of 2160	1628	powershell.exe	103
PID 2160 wrote to memory of 3076	2160	csc.exe	104
PID 2160 wrote to memory of 3076	2160	csc.exe	104
PID 1628 wrote to memory of 3972	1628	powershell.exe	105
PID 1628 wrote to memory of 3972	1628	powershell.exe	105
PID 3972 wrote to memory of 3848	3972	WScript.exe	106
PID 3972 wrote to memory of 3848	3972	WScript.exe	106

C:\Users\Admin\AppData\Local\Temp\miner.exe
"C:\Users\Admin\AppData\Local\Temp\miner.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\d.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\ProgramData\Defender\d.exe
    "C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\d.bat
    3⤵
    - Executes dropped EXE
    PID:60
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:3172
- C:\ProgramData\Defender\ab.exe
  C:\ProgramData\Defender\ab.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\dd.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\ProgramData\Defender\d.exe
      "C:\ProgramData\Defender\d.exe" 61 C:\ProgramData\Defender\dd.bat
      4⤵
      Executes dropped EXE
      PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\t.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC ONLOGON /TN "Windows Protection" /TR "C:\ProgramData\Defender\Start.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:4004
- C:\ProgramData\Defender\ac.exe
  C:\ProgramData\Defender\ac.exe -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\ProgramData\Defender\min.exe
    "C:\ProgramData\Defender\min.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\ProgramData\Defender\Start.exe
      C:\ProgramData\Defender\Start.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:884
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A156.tmp\A157.tmp\A158.bat C:\ProgramData\Defender\Start.exe"
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3428
      - C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:2052
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\s.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Defender\s.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -executionpolicy Unrestricted C:\ProgramData\Defender\timeout.ps1
        8⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\riodaadr\riodaadr.cmdline"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD324.tmp" "c:\Users\Admin\AppData\Local\Temp\riodaadr\CSCD547A31B950B4E7CA62576B9BE3841B6.TMP"
        10⤵
        
        PID:3076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Defender\p.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\ProgramData\Defender\Windows Protection.exe
        
        "C:\ProgramData\Defender\Windows Protection.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3848
        
        C:\ProgramData\Task Host\svchost.exe
        
        "C:\ProgramData\Task Host\svchost.exe"
        7⤵
        Executes dropped EXE
        
        PID:3996
      - C:\ProgramData\Task Host\svchost.exe
        
        "C:\ProgramData\Task Host\svchost.exe"
        6⤵
        Executes dropped EXE
        
        PID:2808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-31-0x0000000140000000-0x0000000140023000-memory.dmp

Download

memory/1628-58-0x0000023535190000-0x0000023535191000-memory.dmp

Download

memory/1628-47-0x00007FFE6DC50000-0x00007FFE6E63C000-memory.dmp

Download

memory/1628-48-0x0000023533060000-0x0000023533061000-memory.dmp

Download

memory/1628-49-0x0000023535210000-0x0000023535211000-memory.dmp

Download

memory/2808-69-0x0000000000874000-0x0000000000892000-memory.dmp

Download

memory/3728-41-0x000001D79F140000-0x000001D79F144000-memory.dmp

Download

memory/3848-65-0x00007FF720170000-0x00007FF72088A000-memory.dmp

Download

memory/3996-66-0x0000000002B02000-0x0000000002B67000-memory.dmp

Download

memory/3996-68-0x0000000000A68000-0x0000000000A86000-memory.dmp

Download