xmrig | 9ca0de5b060df94714b3defd24f99d53e63414abdee90e113647b77ed3ea9036

General

Target
026d6396aafd4e1706c5ec311de66487.exe
Size 112KB
Sample211025-jerjssfge2
SHA256 9ca0de5b060df94714b3defd24f99d53e63414abdee90e113647b77ed3ea9036
MD5 026d6396aafd4e1706c5ec311de66487
SHA1 01a43562db3eb021aa4531c2e292fa92414cff0c
SHA512 d080ea922b4d9831ca0d69841046ebb6248f517f7732557ccc9961f28e3b2c58fee0b6e1a5916256fd2d065a3db8eedee017c9021ba2648fe2de1c359e30e091
MD5 SHA1 SHA512

Score

10^/10

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 1 IoCs

pid	Process
1980	serivces.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 3 IoCs

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\serivces.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\serivces.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\fonts\259368828.dll	026d6396aafd4e1706c5ec311de66487.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1296	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	026d6396aafd4e1706c5ec311de66487.exe
3316	026d6396aafd4e1706c5ec311de66487.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3316	026d6396aafd4e1706c5ec311de66487.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3316	026d6396aafd4e1706c5ec311de66487.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 972	3316	026d6396aafd4e1706c5ec311de66487.exe	71
PID 3316 wrote to memory of 972	3316	026d6396aafd4e1706c5ec311de66487.exe	71
PID 3316 wrote to memory of 972	3316	026d6396aafd4e1706c5ec311de66487.exe	71
PID 972 wrote to memory of 1296	972	cmd.exe	73
PID 972 wrote to memory of 1296	972	cmd.exe	73
PID 972 wrote to memory of 1296	972	cmd.exe	73
PID 3920 wrote to memory of 1980	3920	svchost.exe	74
PID 3920 wrote to memory of 1980	3920	svchost.exe	74
PID 3920 wrote to memory of 1980	3920	svchost.exe	74

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "serivces"
1⤵
PID:4084