xmrig | ttp[://]194[.]38[.]20[.]31/wxm[.]exe

General

Target

ttp://194.38.20.31/wxm.exe
Sample

211021-ty4zcaaee2

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\wxm.exe	xmrig
C:\Users\Admin\Downloads\wxm.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

wxm.exe

pid process

1764 wxm.exe

pid	process
1764	wxm.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

Processes:

explorer.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\wxm.exe:Zone.Identifier firefox.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 2196 firefox.exe
Token: SeDebugPrivilege 2196 firefox.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

OpenWith.exefirefox.exe

pid process

3384 OpenWith.exe
2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
2196 firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\wxm.exe:Zone.Identifier	firefox.exe

description	pid	process
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe

pid	process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

pid	process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

pid	process
3384	OpenWith.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 504 wrote to memory of 2196	504	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1280	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1280	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1688	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 1888	2196	firefox.exe	firefox.exe

C:\Windows\explorer.exe
explorer ttp://194.38.20.31/wxm.exe
1⤵
PID:2756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.0.1037069020\1929613754" -parentBuildID 20200403170909 -prefsHandle 1528 -prefMapHandle 1520 -prefsLen 1 -prefMapSize 219631 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 1628 gpu
3⤵
PID:1280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.3.1092083221\651622481" -childID 1 -isForBrowser -prefsHandle 2104 -prefMapHandle 2136 -prefsLen 122 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 2240 tab
3⤵
PID:1688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.13.1069784045\1017722995" -childID 2 -isForBrowser -prefsHandle 3464 -prefMapHandle 3460 -prefsLen 6979 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3476 tab
3⤵
PID:1888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.20.997784353\1172071613" -childID 3 -isForBrowser -prefsHandle 4240 -prefMapHandle 4484 -prefsLen 7750 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4424 tab
3⤵
PID:1916

C:\Users\Admin\Downloads\wxm.exe
"C:\Users\Admin\Downloads\wxm.exe"
1⤵
- Executes dropped EXE
PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Downloads\wxm.exe
MD5
f0cf1d3d9ed23166ff6c1f3deece19b4

SHA1
008cae11fda5a3dee7b7832871b6d654f00ea8e4

SHA256
0663d70411a20340f184ae3b47138b33ac398c800920e4d976ae609b60522b01

SHA512
e966d75e301b8995cdd0274554f97049f840b840294e33970de8d6d9d253e1f6bf710a9c4cf09ea0fa9c32e7967f8dda10afaf67fae1a73b1a3a29e3c8dce35a

Download Submit
C:\Users\Admin\Downloads\wxm.exe
MD5
f0cf1d3d9ed23166ff6c1f3deece19b4

SHA1
008cae11fda5a3dee7b7832871b6d654f00ea8e4

SHA256
0663d70411a20340f184ae3b47138b33ac398c800920e4d976ae609b60522b01

SHA512
e966d75e301b8995cdd0274554f97049f840b840294e33970de8d6d9d253e1f6bf710a9c4cf09ea0fa9c32e7967f8dda10afaf67fae1a73b1a3a29e3c8dce35a

Download Submit
memory/1764-117-0x000001B38F0D0000-0x000001B38F0F0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads