xmrig | 788490416fe054993a1a4033b0f287399167eaad913a1cfc24efe324246645f4

General

Target

Defender.exe
Size

8.3MB
MD5

87fa7a1ee39276516b9753556897546d
SHA1

8c5db106bdda5304dc65a439d4bf806751117424
SHA256

788490416fe054993a1a4033b0f287399167eaad913a1cfc24efe324246645f4
SHA512

c7a9db600886f816b561aa9c73ba25784294b4d5ee537990c6b5efc4d0ed4adc3e728865bd7da692be3dc4f7e57efebadaa36d00b49075f046dacfce9136fe8f

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1092-67-0x0000000140D40000-mapping.dmp	xmrig

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AddInProcess.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AddInProcess.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AddInProcess.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Defender.exe

description pid process target process

PID 1632 set thread context of 1092 1632 Defender.exe AddInProcess.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Defender.exe

pid process

1632 Defender.exe
1632 Defender.exe
1632 Defender.exe
1632 Defender.exe
1632 Defender.exe
1632 Defender.exe

description	pid	process	target process
PID 1632 set thread context of 1092	1632	Defender.exe	AddInProcess.exe

pid	process
1632	Defender.exe
1632	Defender.exe
1632	Defender.exe
1632	Defender.exe
1632	Defender.exe
1632	Defender.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Defender.exeAddInProcess.exe

description	pid	process
Token: SeDebugPrivilege	1632	Defender.exe
Token: SeLockMemoryPrivilege	1092	AddInProcess.exe
Token: SeLockMemoryPrivilege	1092	AddInProcess.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Defender.exe

description	pid	process	target process
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe
PID 1632 wrote to memory of 1092	1632	Defender.exe	AddInProcess.exe

C:\Users\Admin\AppData\Local\Temp\Defender.exe
"C:\Users\Admin\AppData\Local\Temp\Defender.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:14444 -u 43M5FXdYoo56uynqTFUfC1XL4qSDQQoPA1YvSX64zN9SRqA22Bs2qUYHcHGpjS89HBQNeSFVq7ijDcbBuwWnEeurV8hWXNX.Admin -p x --algo rx/0
2⤵
- Checks BIOS information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-66-0x0000000140000000-0x0000000140D5F000-memory.dmp

Filesize
13.4MB

Download
memory/1092-67-0x0000000140D40000-mapping.dmp

Download
memory/1092-68-0x00000000008F0000-0x0000000000910000-memory.dmp

Filesize
128KB

Download
memory/1092-69-0x0000000140000000-0x0000000140D5F000-memory.dmp

Filesize
13.4MB

Download
memory/1092-70-0x0000000000BE0000-0x0000000000C00000-memory.dmp

Filesize
128KB

Download
memory/1092-71-0x0000000000C00000-0x0000000000C20000-memory.dmp

Filesize
128KB

Download
memory/1632-60-0x000000013F5F0000-0x000000013F5F1000-memory.dmp

Filesize
4KB

Download
memory/1632-62-0x000000001BE60000-0x000000001C6CC000-memory.dmp

Filesize
8.4MB

Download
memory/1632-63-0x000000001B4B0000-0x000000001B4B2000-memory.dmp

Filesize
8KB

Download
memory/1632-64-0x000000001FA70000-0x00000000202B3000-memory.dmp

Filesize
8.3MB

Download
memory/1632-65-0x00000000207A0000-0x0000000020FD3000-memory.dmp

Filesize
8.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads