xmrig | f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc

General

Target

f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
Size

3.7MB
MD5

a432acc0bb092e132b86495f5426c7f3
SHA1

dac2e718385da39927276b48fa5e7bda9559ca9a
SHA256

f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc
SHA512

ba74f47ccdf8265322d50547fbe13bff703abaabcc017d0fa4650eae1e90aab216f07f2bffcf736ac31d1184d908ad2e2589be7d68e09d1f21c139965a78bc98

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner

XMRig Miner Payload 4 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe	xmrig
C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe	xmrig
C:\Users\Admin\AppData\Roaming\X64\Netframwork64.exe	xmrig
C:\Users\Admin\AppData\Roaming\X64\Netframwork64.exe	xmrig

Executes dropped EXE 2 IoCs

Processes:

NvContainerLocalSystem64.exeNetframwork64.exe

pid process

1304 NvContainerLocalSystem64.exe
1376 Netframwork64.exe

pid	process
1304	NvContainerLocalSystem64.exe
1376	Netframwork64.exe

Drops startup file 2 IoCs

Processes:

f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update_NvContainerLocalSystem64.lnk	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update_NvContainerLocalSystem64.lnk	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

988 schtasks.exe

pid	process
988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exeNvContainerLocalSystem64.exe

pid	process
4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
1304	NvContainerLocalSystem64.exe
1304	NvContainerLocalSystem64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Netframwork64.exe

description pid process

Token: SeLockMemoryPrivilege 1376 Netframwork64.exe
Token: SeLockMemoryPrivilege 1376 Netframwork64.exe

description	pid	process
Token: SeLockMemoryPrivilege	1376	Netframwork64.exe
Token: SeLockMemoryPrivilege	1376	Netframwork64.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exeNvContainerLocalSystem64.exe

description	pid	process	target process
PID 4772 wrote to memory of 988	4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe	schtasks.exe
PID 4772 wrote to memory of 988	4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe	schtasks.exe
PID 4772 wrote to memory of 988	4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe	schtasks.exe
PID 4772 wrote to memory of 1304	4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe	NvContainerLocalSystem64.exe
PID 4772 wrote to memory of 1304	4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe	NvContainerLocalSystem64.exe
PID 4772 wrote to memory of 1304	4772	f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe	NvContainerLocalSystem64.exe
PID 1304 wrote to memory of 1376	1304	NvContainerLocalSystem64.exe	Netframwork64.exe
PID 1304 wrote to memory of 1376	1304	NvContainerLocalSystem64.exe	Netframwork64.exe

C:\Users\Admin\AppData\Local\Temp\f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe
"C:\Users\Admin\AppData\Local\Temp\f419e4f736fed46524a5297a09ce3fa86c1f62088b73a2bb95c8bd6108fc79bc.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\System32\schtasks.exe /create /tn X64 /sc minute /mo 5 /TR C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe
2⤵
- Creates scheduled task(s)
PID:988

C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe
"C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Roaming\X64\Netframwork64.exe
C:\Users\Admin\AppData\Roaming\X64\Netframwork64.exe -o stratum+tcp://pool.supportxmr.com:80 --max-cpu-usage=50 --cpu-priority=0 --donate-level=1 --safe -r 5 -u 4Hm3YrYNgczRAP7jbGCZ7vA8XwbBR8DWMU7Bm9FKZqjxQXPPcwMP1kDbK3mtBSdt2c6TmLCPiMSXa39uBiEBwkg4FUxbV7bA4GhS2SfS7S -p X64:XMRDZ@GMAIL.COM -k
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\X64\Netframwork64.exe
MD5
86207defcd882e7021cd566063c93c82

SHA1
ea6217872e5eb27e6ce712a2db880d010e8e026d

SHA256
b8acc05efb70629ba04b490ad135c1c17007e046b3ec2faa529d45f4cb781cba

SHA512
4ad9e937cfeb586e18d855c8e048ba437dca4de1bfa5f3ae197f5a36dbcccf6b7c7a6e94dfa54ae0c6b59619aa0e68c22b807496839805a35f0c7a668f87c1e2

Download Submit
C:\Users\Admin\AppData\Roaming\X64\Netframwork64.exe
MD5
86207defcd882e7021cd566063c93c82

SHA1
ea6217872e5eb27e6ce712a2db880d010e8e026d

SHA256
b8acc05efb70629ba04b490ad135c1c17007e046b3ec2faa529d45f4cb781cba

SHA512
4ad9e937cfeb586e18d855c8e048ba437dca4de1bfa5f3ae197f5a36dbcccf6b7c7a6e94dfa54ae0c6b59619aa0e68c22b807496839805a35f0c7a668f87c1e2

Download Submit
C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe
MD5
cfbedca82a040afc202ca9ebefc8437f

SHA1
43253d152863c8d630d15b0257542501c3716a16

SHA256
24e752ab001bea9bbae534bd73188fff318f7733caa33593ddfff280f75d3279

SHA512
4ae6129037e2c197ab5eb230159398c77cf55086204a5ca2962fea197018ad9649f727c75538d2fd52f71de54bd6e3e6140356b96a99b486ddba5b486a1f3d77

Download Submit
C:\Users\Admin\AppData\Roaming\X64\NvContainerLocalSystem64.exe
MD5
cfbedca82a040afc202ca9ebefc8437f

SHA1
43253d152863c8d630d15b0257542501c3716a16

SHA256
24e752ab001bea9bbae534bd73188fff318f7733caa33593ddfff280f75d3279

SHA512
4ae6129037e2c197ab5eb230159398c77cf55086204a5ca2962fea197018ad9649f727c75538d2fd52f71de54bd6e3e6140356b96a99b486ddba5b486a1f3d77

Download Submit
memory/988-2-0x0000000000000000-mapping.dmp

Download
memory/1304-3-0x0000000000000000-mapping.dmp

Download
memory/1376-6-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads