xmrig | 06381f7fd865363d44156b4308e09164804ad102d6e493239723b7d89ca30b44

Analysis

Target

LinkMiner.exe
Size

47KB
MD5

252abb0504523f55a08c29bbe6460bcc
SHA1

0ee2118397347c297e840f3a204a44179f924b3d
SHA256

06381f7fd865363d44156b4308e09164804ad102d6e493239723b7d89ca30b44
SHA512

32a66496236149a99e2bd4dfb165aee0dd1f7e076792ef4df0f2e8ba3c6f783189701faba3ebf0d730a3c9e91094f3fc240d8cd777f694c14336610f33d0aa4c

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 1 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\reference\xmrig.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

xmrig.exe

pid process

3976 xmrig.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

LinkMiner.exexmrig.exe

description pid process

Token: SeDebugPrivilege 808 LinkMiner.exe
Token: SeLockMemoryPrivilege 3976 xmrig.exe
Token: SeLockMemoryPrivilege 3976 xmrig.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

LinkMiner.exe

description pid process target process

PID 808 wrote to memory of 3976 808 LinkMiner.exe xmrig.exe
PID 808 wrote to memory of 3976 808 LinkMiner.exe xmrig.exe

pid	process
3976	xmrig.exe

description	pid	process
Token: SeDebugPrivilege	808	LinkMiner.exe
Token: SeLockMemoryPrivilege	3976	xmrig.exe
Token: SeLockMemoryPrivilege	3976	xmrig.exe

description	pid	process	target process
PID 808 wrote to memory of 3976	808	LinkMiner.exe	xmrig.exe
PID 808 wrote to memory of 3976	808	LinkMiner.exe	xmrig.exe

C:\Users\Admin\AppData\Roaming\reference\xmrig.exe
MD5
aa318a599fee3d322d6b5fa6d4b568de

SHA1
b2dff433338f5cf776741d3db7c03ed48c220a58

SHA256
9b324b9905c4e32ccf5cba0249ab82262173486f6382e170cbf2fafab1846fd9

SHA512
b2a9f03d30a0fea28b6fff811ecf443454eb782c71487926fca9c179d7352c4864c5b27fb9dfd3f34a3641cb65d25f8ab6c5d16f2856033fe88c90a2ef44c3e0

Download Submit
memory/808-114-0x00000212D5D50000-0x00000212D5D51000-memory.dmp

Filesize
4KB

Download
memory/808-116-0x00000212D6040000-0x00000212D6041000-memory.dmp

Filesize
4KB

Download
memory/808-117-0x00000212F0320000-0x00000212F0322000-memory.dmp

Filesize
8KB

Download
memory/3976-118-0x0000000000000000-mapping.dmp

Download
memory/3976-120-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/3976-121-0x00000000001D0000-0x00000000001F0000-memory.dmp

Filesize
128KB

Download
memory/3976-122-0x00000000011C0000-0x00000000011E0000-memory.dmp

Filesize
128KB

Download