xmrig | b82c510a4e89d91316acab7f61ea599a4ee4ef7ccde2ed71cd46fa9875c0639c

General

Target
17f4e8ef4e0b821ac222dbf1dab08889.exe
Size 112KB
Sample210706-8mfrwhcs8e
SHA256 b82c510a4e89d91316acab7f61ea599a4ee4ef7ccde2ed71cd46fa9875c0639c
MD5 17f4e8ef4e0b821ac222dbf1dab08889
SHA1 e6c5aa708c9787e84ae2894de4abc8824bfa97eb
SHA512 3ef3af9668a4d28564ce98870f964be75c035a87792d5d60ec533fa0c16e2ef814cb5006d35a9a2f8ed26fa23c31d05188973dcb21faa8919702c1e8f05f5b59
MD5 SHA1 SHA512

Score

10^/10

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 1 IoCs

pid	Process
1604	serivces.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 3 IoCs

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\serivces.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\serivces.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\fonts\259267750.dll	17f4e8ef4e0b821ac222dbf1dab08889.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2560	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3560	17f4e8ef4e0b821ac222dbf1dab08889.exe
3560	17f4e8ef4e0b821ac222dbf1dab08889.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3560	17f4e8ef4e0b821ac222dbf1dab08889.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3560	17f4e8ef4e0b821ac222dbf1dab08889.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2096	3560	17f4e8ef4e0b821ac222dbf1dab08889.exe	77
PID 3560 wrote to memory of 2096	3560	17f4e8ef4e0b821ac222dbf1dab08889.exe	77
PID 3560 wrote to memory of 2096	3560	17f4e8ef4e0b821ac222dbf1dab08889.exe	77
PID 2096 wrote to memory of 2560	2096	cmd.exe	79
PID 2096 wrote to memory of 2560	2096	cmd.exe	79
PID 2096 wrote to memory of 2560	2096	cmd.exe	79
PID 652 wrote to memory of 1604	652	svchost.exe	83
PID 652 wrote to memory of 1604	652	svchost.exe	83
PID 652 wrote to memory of 1604	652	svchost.exe	83

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "serivces"
1⤵
PID:4064