xmrig | 7ac0238cad41d79e2fa25d52f32f6d670aeacdbc995de3125c657ebfd9edad2a

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
24/06/2021, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6d0f729c0717bae61ce9886e1dbd0d6.exe
Size 6.4MB
Sample210624-eselaksm4e
SHA256 7ac0238cad41d79e2fa25d52f32f6d670aeacdbc995de3125c657ebfd9edad2a
MD5 b6d0f729c0717bae61ce9886e1dbd0d6
SHA1 3103c8e427f0afde6761b085eb6165eceed2b712
SHA512 11901a05f937fea9375e7a26496151ba9c1fb86f1e65b69674aafc144f68c1b864ca352526688dcd2cac826a0b540ca596ed9f74d09ab19b2f37b25ca706c225
MD5 SHA1 SHA512

Score

10^/10

xmrig evasion miner spyware stealer

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

resource	yara_rule
behavioral2/files/0x000100000001ab5f-131.dat	xmrig
behavioral2/files/0x000100000001ab5f-132.dat	xmrig
behavioral2/files/0x000100000001ab5f-145.dat	xmrig

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
1112	autoupdate.exe
1768	procdump.exe
2248	procdump64.exe
2504	updater.exe
3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe
3928	updater.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4356	schtasks.exe
4996	schtasks.exe

GoLang User-Agent 8 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	13	Go-http-client/1.1
HTTP User-Agent header	17	Go-http-client/1.1
HTTP User-Agent header	19	Go-http-client/1.1
HTTP User-Agent header	20	Go-http-client/1.1
HTTP User-Agent header	21	Go-http-client/1.1
HTTP User-Agent header	24	Go-http-client/1.1
HTTP User-Agent header	25	Go-http-client/1.1
HTTP User-Agent header	9	Go-http-client/1.1

Kills process with taskkill 4 IoCs

evasion

pid	Process
5108	taskkill.exe
3344	taskkill.exe
1128	taskkill.exe
4396	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe
4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe
1768	procdump.exe
1768	procdump.exe
1768	procdump.exe
1768	procdump.exe
2248	procdump64.exe
2248	procdump64.exe
2248	procdump64.exe
2248	procdump64.exe
2248	procdump64.exe
2248	procdump64.exe
3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe
3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	1768	procdump.exe
Token: SeDebugPrivilege	2248	procdump64.exe
Token: SeLockMemoryPrivilege	2504	updater.exe
Token: SeLockMemoryPrivilege	2504	updater.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeLockMemoryPrivilege	3928	updater.exe
Token: SeLockMemoryPrivilege	3928	updater.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4736	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	69
PID 4648 wrote to memory of 4736	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	69
PID 4648 wrote to memory of 4876	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	73
PID 4648 wrote to memory of 4876	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	73
PID 4876 wrote to memory of 4996	4876	cmd.exe	76
PID 4876 wrote to memory of 4996	4876	cmd.exe	76
PID 4648 wrote to memory of 5108	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	78
PID 4648 wrote to memory of 5108	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	78
PID 4648 wrote to memory of 3344	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	85
PID 4648 wrote to memory of 3344	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	85
PID 4648 wrote to memory of 1112	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	88
PID 4648 wrote to memory of 1112	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	88
PID 4648 wrote to memory of 1128	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	89
PID 4648 wrote to memory of 1128	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	89
PID 1112 wrote to memory of 1768	1112	autoupdate.exe	91
PID 1112 wrote to memory of 1768	1112	autoupdate.exe	91
PID 1112 wrote to memory of 1768	1112	autoupdate.exe	91
PID 1768 wrote to memory of 2248	1768	procdump.exe	93
PID 1768 wrote to memory of 2248	1768	procdump.exe	93
PID 4648 wrote to memory of 2504	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	94
PID 4648 wrote to memory of 2504	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	94
PID 4648 wrote to memory of 3228	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	96
PID 4648 wrote to memory of 3228	4648	b6d0f729c0717bae61ce9886e1dbd0d6.exe	96
PID 3228 wrote to memory of 4016	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	97
PID 3228 wrote to memory of 4016	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	97
PID 3228 wrote to memory of 4028	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	99
PID 3228 wrote to memory of 4028	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	99
PID 4028 wrote to memory of 4356	4028	cmd.exe	101
PID 4028 wrote to memory of 4356	4028	cmd.exe	101
PID 3228 wrote to memory of 4396	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	102
PID 3228 wrote to memory of 4396	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	102
PID 3228 wrote to memory of 3928	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	104
PID 3228 wrote to memory of 3928	3228	b6d0f729c0717bae61ce9886e1dbd0d6.exe	104

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4016	attrib.exe
4736	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe
"C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\attrib.exe
  attrib +S +H C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Views/modifies file attributes
  PID:4736
- C:\Windows\system32\cmd.exe
  C:\\Windows\system32\cmd.exe /c "schtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 03:36 /F"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 03:36 /F
    3⤵
    - Creates scheduled task(s)
    PID:4996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im download.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im autoupdate.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\autoupdate.exe
  C:\Users\Admin\AppData\Local\Temp/autoupdate.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\procdump.exe
    C:\Users\Admin\AppData\Local\Temp/procdump.exe -accepteula -ma lsass.exe C:\Users\Admin\AppData\Local\Temp/1.dmp
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\procdump64.exe
      C:\Users\Admin\AppData\Local\Temp/procdump.exe -accepteula -ma lsass.exe C:\Users\Admin\AppData\Local\Temp/1.dmp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im updater.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\updater.exe
  C:\Users\Admin\AppData\Local\Temp/updater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe
  C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\system32\attrib.exe
    attrib +S +H C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Views/modifies file attributes
    PID:4016
- - C:\Windows\system32\cmd.exe
    C:\\Windows\system32\cmd.exe /c "schtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 02:19 /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 02:19 /F
      4⤵
      Creates scheduled task(s)
      PID:4356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im updater.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\updater.exe
    C:\Users\Admin\AppData\Local\Temp/updater.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-133-0x0000028737E90000-0x0000028737EB0000-memory.dmp

Download

memory/3928-150-0x000001729FE90000-0x000001729FEB0000-memory.dmp

Download

memory/3928-149-0x000001729FE50000-0x000001729FE70000-memory.dmp

Download