Overview

overview

10

Static

static

8

04443c70d3...be.exe

windows7_x64

9

04443c70d3...be.exe

windows10_x64

9

05535d72f3...06.exe

windows7_x64

1

05535d72f3...06.exe

windows10_x64

1

1bec139d54...72.exe

windows7_x64

8

1bec139d54...72.exe

windows10_x64

8

1f670ff8cc...55.exe

windows7_x64

1

1f670ff8cc...55.exe

windows10_x64

1

2deaa0ec74...ea.exe

windows7_x64

10

2deaa0ec74...ea.exe

windows10_x64

10

372b929ae9...ef.dll

windows7_x64

9

372b929ae9...ef.dll

windows10_x64

9

38ee6bea62...15.exe

windows7_x64

3

38ee6bea62...15.exe

windows10_x64

3

437d91ce52...8f.exe

windows7_x64

1

437d91ce52...8f.exe

windows10_x64

4

447058c1c6...a8.exe

windows7_x64

9

447058c1c6...a8.exe

windows10_x64

9

5061c0b08d...03.exe

windows7_x64

1

5061c0b08d...03.exe

windows10_x64

1

5ed4b682ef...d4.exe

windows7_x64

8

5ed4b682ef...d4.exe

windows10_x64

8

6970600d21...b5.exe

windows7_x64

1

6970600d21...b5.exe

windows10_x64

1

72f528f9a6...92.exe

windows7_x64

8

72f528f9a6...92.exe

windows10_x64

8

73dcee7abe...99.exe

windows7_x64

1

73dcee7abe...99.exe

windows10_x64

1

7e118b534a...d2.exe

windows7_x64

10

7e118b534a...d2.exe

windows10_x64

10

8034fffb03...3c.exe

windows7_x64

10

8034fffb03...3c.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-03-2021 09:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe

  • Size

    1.2MB

  • MD5

    629616cf3527c449d804903309e7ce66

  • SHA1

    90374cb88ca94ed7cc0ec7a0eca33be01e40b6d0

  • SHA256

    7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2

  • SHA512

    da12c2757632698ea0ba35261c95a3c712b3f4a2d276b628fba703d2a2c4c2e2d2929c6dc178c1cd18142d6010e54ef9b7b8b8f009ed5b402007bc7cd431fa67

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 1 IoCs
    miner
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe
    "C:\Users\Admin\AppData\Local\Temp\7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Windows\notepad.exe
      "C:\Windows\notepad.exe" -c "C:\ProgramData\WrdJdgYRmg\cfgi"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\WrdJdgYRmg\cfgi
    MD5

    0a05419aa1fb936845ca8ca8628d67bd

    SHA1

    3fea82ca385e8b9724e9c24fedf62de551b79bf2

    SHA256

    976655563c751df243c091dfa4cbae8b767a6e6c403ea5aeb89288b5bce64312

    SHA512

    e5eacf3e72c17363d1bdaddd1746ae08b0aef066e3035019b684b9e1cfd01e674a8f6e41bc6b7f1009fea934070b6bcc6edcff494f33903e117b331e57ba8aad

    Download Submit

  • memory/512-2-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

    Download

  • memory/2920-3-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2920-4-0x000000000050F100-mapping.dmp

    Download

  • memory/2920-5-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2920-7-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

    Download