xmrig | 5cf202837c24442de4f09ee9a152c77f911b405541fd30567bcc370ef61f5f75

General

Target

notepad.exe
Size

2.8MB
MD5

4930920087503d221d8bb13e1514620b
SHA1

07e2d9be6cce22e6b1b44992acf2d536c3675e07
SHA256

5cf202837c24442de4f09ee9a152c77f911b405541fd30567bcc370ef61f5f75
SHA512

9204d17902fb794600e5efb538f0269340393a84cf3c72ceb27884ab1f5f215a46c42a9f5de457167953d9bcdf7148d9a3b12d22812347af20e5e073a2802f0f

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1340-69-0x0000000000A14AA0-mapping.dmp	xmrig
behavioral1/memory/1340-70-0x0000000000400000-0x0000000000A16000-memory.dmp	xmrig
behavioral1/memory/1340-73-0x0000000000401000-0x0000000000938000-memory.dmp	xmrig

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1340-67-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1340-68-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1340-70-0x0000000000400000-0x0000000000A16000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url	wscript.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

notepad.exenotepad.exe

description	pid	process	target process
PID 792 set thread context of 556	792	notepad.exe	notepad.exe
PID 556 set thread context of 1340	556	notepad.exe	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

notepad.exe

pid	process
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe
556	notepad.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

notepad.exenotepad.exe

description pid process

Token: SeDebugPrivilege 556 notepad.exe
Token: SeLockMemoryPrivilege 1340 notepad.exe
Token: SeLockMemoryPrivilege 1340 notepad.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

notepad.exe

pid process

792 notepad.exe

description	pid	process
Token: SeDebugPrivilege	556	notepad.exe
Token: SeLockMemoryPrivilege	1340	notepad.exe
Token: SeLockMemoryPrivilege	1340	notepad.exe

pid	process
792	notepad.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

notepad.exenotepad.execmd.exe

description	pid	process	target process
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 792 wrote to memory of 556	792	notepad.exe	notepad.exe
PID 556 wrote to memory of 792	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 792	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1340	556	notepad.exe	notepad.exe
PID 556 wrote to memory of 1616	556	notepad.exe	cmd.exe
PID 556 wrote to memory of 1616	556	notepad.exe	cmd.exe
PID 556 wrote to memory of 1616	556	notepad.exe	cmd.exe
PID 556 wrote to memory of 1616	556	notepad.exe	cmd.exe
PID 556 wrote to memory of 1616	556	notepad.exe	cmd.exe
PID 556 wrote to memory of 1616	556	notepad.exe	cmd.exe
PID 1616 wrote to memory of 2016	1616	cmd.exe	wscript.exe
PID 1616 wrote to memory of 2016	1616	cmd.exe	wscript.exe
PID 1616 wrote to memory of 2016	1616	cmd.exe	wscript.exe
PID 1616 wrote to memory of 2016	1616	cmd.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\notepad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\notepad.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\wscript.exe
WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"
4⤵
- Drops startup file
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LKBNMTFJgl\cfgi
MD5
2de48065534a637941090d8f3e04044f

SHA1
eeab2c38dd711a9badb8265e11963732ea9c84db

SHA256
8abf520009cea0e0c1b67563fd89c4c0e0403744942763d843e39eed180a1ed7

SHA512
2d1466d5f09df4f6628092a2d7d210728536a1649cfecae362d907d61088e32574290a350848f161c67fe008b2e46864161134c63560763be932c3a631a24dc1

Download Submit
C:\ProgramData\LKBNMTFJgl\r.vbs
MD5
19b2d791962e01151e4b6a40a90e8cd8

SHA1
a1ee500267dd1d457b3f840f8a00ba808bb46eb3

SHA256
67824e30ec5d2b61ffb266e8a37e9b929e82d507d09d21961b8293c99816c664

SHA512
4d39fd8f11e86490041190f1419273c702ccd85dcc603e5d7acc9d55cc60031ef1f7cc901a2c09b46d6bdc560a4c81d464c8495e7f9e8707ec7cd999f49c49fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url
MD5
e03e6937ba1878ace3d849b233adecfe

SHA1
affbb4f8b53af6cf35660b775a0a8f70fb95f8b5

SHA256
9846a8975f8e2dbc96cd18d5015c03b4d8226fddf69bcb99a0610c855b0a9e6d

SHA512
99ea03b8635d89409c6e65dc1dd1e995eac8c02e373f3b01faa7d715f347722075cc0d5d629914399505a2ca8ffb80bfa8cafa9d99a2e702d1fcd94fb0baeca9

Download Submit
memory/556-62-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/556-63-0x0000000000404470-mapping.dmp

Download
memory/556-64-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/556-65-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/792-66-0x0000000002850000-0x0000000002A24000-memory.dmp

Filesize
1.8MB

Download
memory/1340-73-0x0000000000401000-0x0000000000938000-memory.dmp

Filesize
5.2MB

Download
memory/1340-72-0x00000000000E0000-0x00000000000F4000-memory.dmp

Filesize
80KB

Download
memory/1340-70-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1340-71-0x0000000000938000-0x0000000000A15000-memory.dmp

Filesize
884KB

Download
memory/1340-69-0x0000000000A14AA0-mapping.dmp

Download
memory/1340-75-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/1340-76-0x00000000002E0000-0x0000000000300000-memory.dmp

Filesize
128KB

Download
memory/1340-68-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1340-67-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1616-77-0x0000000000000000-mapping.dmp

Download
memory/1616-79-0x00000000003B0000-0x0000000000584000-memory.dmp

Filesize
1.8MB

Download
memory/2016-78-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads