xmrig | a98ccb74c29d4e6c3929cfea2f157dd53ce9c3ea67bd25934aab24f416ce9d13

General

Target

xmr.exe
Size

1.8MB
MD5

b1e29e528a7510be3c04dcff622f63ab
SHA1

ae8a2d88a4b0bcd8a11364be5a687f2a2a86d83a
SHA256

a98ccb74c29d4e6c3929cfea2f157dd53ce9c3ea67bd25934aab24f416ce9d13
SHA512

e7f59ab406d79832dacd0c4bdeb4bbbe8cc626bcf247502f8a817d2f2e39449450806976f5cb725a35f1bb1a58ef41488b32d6aea9cf3a54590c7989d3696040

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1172-63-0x0000000000A14AA0-mapping.dmp	xmrig
behavioral1/memory/1172-64-0x0000000000400000-0x0000000000A16000-memory.dmp	xmrig
behavioral1/memory/1172-68-0x0000000000401000-0x0000000000938000-memory.dmp	xmrig

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1172-61-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1172-62-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1172-64-0x0000000000400000-0x0000000000A16000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gCJCBpvUDZ.url wscript.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xmr.exe

description pid process target process

PID 1820 set thread context of 1172 1820 xmr.exe notepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gCJCBpvUDZ.url	wscript.exe

description	pid	process	target process
PID 1820 set thread context of 1172	1820	xmr.exe	notepad.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

xmr.exe

pid	process
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe
1820	xmr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

xmr.exenotepad.exe

description pid process

Token: SeDebugPrivilege 1820 xmr.exe
Token: SeLockMemoryPrivilege 1172 notepad.exe
Token: SeLockMemoryPrivilege 1172 notepad.exe

description	pid	process
Token: SeDebugPrivilege	1820	xmr.exe
Token: SeLockMemoryPrivilege	1172	notepad.exe
Token: SeLockMemoryPrivilege	1172	notepad.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

xmr.execmd.exe

description	pid	process	target process
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1172	1820	xmr.exe	notepad.exe
PID 1820 wrote to memory of 1056	1820	xmr.exe	cmd.exe
PID 1820 wrote to memory of 1056	1820	xmr.exe	cmd.exe
PID 1820 wrote to memory of 1056	1820	xmr.exe	cmd.exe
PID 1820 wrote to memory of 1056	1820	xmr.exe	cmd.exe
PID 1056 wrote to memory of 1488	1056	cmd.exe	wscript.exe
PID 1056 wrote to memory of 1488	1056	cmd.exe	wscript.exe
PID 1056 wrote to memory of 1488	1056	cmd.exe	wscript.exe
PID 1056 wrote to memory of 1488	1056	cmd.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\xmr.exe
"C:\Users\Admin\AppData\Local\Temp\xmr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C WScript "C:\ProgramData\CjtqpVHEcA\r.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\wscript.exe
WScript "C:\ProgramData\CjtqpVHEcA\r.vbs"
3⤵
- Drops startup file
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CjtqpVHEcA\cfgi
MD5
62ee13ef8ee70ac648efca0949b3e474

SHA1
ad6cbd2d24d4571a4c38494ab2508de23abe4d68

SHA256
74365150ff9a14cbfba07313e7e1c397a234b84aad606b64fa2310c6b213b2a8

SHA512
fa04705b160da767d04b5cd8299b6c9c1015e6c8d9b45643ccd72c2bee522a43f917967ad5d0600fcc599ec16fafbdc069f0e36337367a5e4caf7b1979d884aa

Download Submit
C:\ProgramData\CjtqpVHEcA\r.vbs
MD5
0065ee24d4dd8d3de7357eca05dd7605

SHA1
8ec12f52f6c59a894c0d7aa829be62f0a9423a92

SHA256
5b5f9317f61c56cf5f568327c0220b23287f7043b071e93e1f3a2d3f31cacda3

SHA512
71966d11180ee59316922b576d6c1d5ec80694d899f861d83e28012418fedf57b0a3a53d5de2e3f52dde1cf376fc57efbe4b8ef1a182d5a798c02ac291265bb6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gCJCBpvUDZ.url
MD5
0d14a943975c648c95879341d15993c5

SHA1
f3b9af3e748daee22572d5b9d94e5b25795acb04

SHA256
9a0efbbe99d58279d8df483820fc8d0990719164254def0109564540cad9dc58

SHA512
f898b8421ecf615d501c883ffb395da9d3512d6918100b8a1061121b6540d7d6cfae96b07b80eeba4bba0c940c567f0630031609917ec86904420045de9f2c9f

Download Submit
memory/1056-71-0x0000000000000000-mapping.dmp

Download
memory/1172-63-0x0000000000A14AA0-mapping.dmp

Download
memory/1172-64-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1172-65-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/1172-66-0x0000000000938000-0x0000000000A15000-memory.dmp

Filesize
884KB

Download
memory/1172-68-0x0000000000401000-0x0000000000938000-memory.dmp

Filesize
5.2MB

Download
memory/1172-70-0x0000000002150000-0x0000000002170000-memory.dmp

Filesize
128KB

Download
memory/1172-69-0x00000000003D0000-0x00000000003F0000-memory.dmp

Filesize
128KB

Download
memory/1172-62-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1172-61-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1488-72-0x0000000000000000-mapping.dmp

Download
memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads