xmrig | ba42981857aaa86ac3ebfa7c169d3abff15ef53a857770d70fa4808a90238d67

General

Target

gh.exe
Size

1.9MB
MD5

fc2f9bb8ec49b7a862a994d7793cfbfa
SHA1

2ac1aa2e6884a811b5517564efeb101bcd6acf23
SHA256

ba42981857aaa86ac3ebfa7c169d3abff15ef53a857770d70fa4808a90238d67
SHA512

56b2f07acf0346e04894ac1bef83515bdda00a0d27262a4abe34799dc49ca996f796fda541fd6d3edda7f05187c9500f52ef694a3c1ddac3839b3047bef66524

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

gh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\rundll.exe\","	gh.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4880-143-0x00000001407DA9E0-mapping.dmp	xmrig
behavioral2/memory/4880-146-0x0000000140000000-0x00000001407E1000-memory.dmp	xmrig

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4880-142-0x0000000140000000-0x00000001407E1000-memory.dmp	upx
behavioral2/memory/4880-144-0x0000000140000000-0x00000001407E1000-memory.dmp	upx
behavioral2/memory/4880-145-0x0000000140000000-0x00000001407E1000-memory.dmp	upx
behavioral2/memory/4880-146-0x0000000140000000-0x00000001407E1000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

gh.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation gh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	gh.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

gh.exeInstallUtil.exe

description	pid	process	target process
PID 2692 set thread context of 4956	2692	gh.exe	InstallUtil.exe
PID 4956 set thread context of 4880	4956	InstallUtil.exe	AddInProcess.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

powershell.exepowershell.exegh.exeInstallUtil.exe

pid	process
4912	powershell.exe
4912	powershell.exe
3880	powershell.exe
3880	powershell.exe
2692	gh.exe
2692	gh.exe
2692	gh.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe
4956	InstallUtil.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

668

pid	process
668

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exegh.exepowershell.exeInstallUtil.exeAddInProcess.exe

description	pid	process
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	2692	gh.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	4956	InstallUtil.exe
Token: SeLockMemoryPrivilege	4880	AddInProcess.exe
Token: SeLockMemoryPrivilege	4880	AddInProcess.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AddInProcess.exe

pid process

4880 AddInProcess.exe

pid	process
4880	AddInProcess.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

gh.exeInstallUtil.exe

description	pid	process	target process
PID 2692 wrote to memory of 4912	2692	gh.exe	powershell.exe
PID 2692 wrote to memory of 4912	2692	gh.exe	powershell.exe
PID 2692 wrote to memory of 3880	2692	gh.exe	powershell.exe
PID 2692 wrote to memory of 3880	2692	gh.exe	powershell.exe
PID 2692 wrote to memory of 4956	2692	gh.exe	InstallUtil.exe
PID 2692 wrote to memory of 4956	2692	gh.exe	InstallUtil.exe
PID 2692 wrote to memory of 4956	2692	gh.exe	InstallUtil.exe
PID 2692 wrote to memory of 4956	2692	gh.exe	InstallUtil.exe
PID 2692 wrote to memory of 4956	2692	gh.exe	InstallUtil.exe
PID 2692 wrote to memory of 4956	2692	gh.exe	InstallUtil.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe
PID 4956 wrote to memory of 4880	4956	InstallUtil.exe	AddInProcess.exe

C:\Users\Admin\AppData\Local\Temp\gh.exe
"C:\Users\Admin\AppData\Local\Temp\gh.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AEEAcgB0AC0AUwBsAEUAZQBQACAALQBzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXAByAHUAbgBkAGwAbAAuAGUAeABlACcA
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr.2miners.com:2222 -u 45xGjpCYwjcFg8yytjgvE4iUzM7EZxqAUQT4c1bGz4uXUJKRrK3ZCac7zsfWbA6fdnHYDZDXpbo86LkfSrWmkWptV9fvM6z.cr2 -p x --algo rx/0 --cpu-max-threads-hint=50
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3db5a3b556b01c59c5812cb86abb674e

SHA1
3848e5419d5c47879f159247e4f1b08005674cf0

SHA256
218d487f881ce9640acd16f7476b445471b83671569e99973f77d0bbf6c42ffa

SHA512
3eb6575d3e476053a65b2631b0cd0d584056ca476058ee2706c69fe10b0502460c40f8985f1f4666e42fba2809924f6dc34ba2e9b2629217542e45cb3640adcd

Download Submit
memory/2692-130-0x0000000000A20000-0x0000000000C00000-memory.dmp

Filesize
1.9MB

Download
memory/2692-133-0x00007FF8767B0000-0x00007FF877271000-memory.dmp

Filesize
10.8MB

Download
memory/3880-138-0x00007FF8767B0000-0x00007FF877271000-memory.dmp

Filesize
10.8MB

Download
memory/3880-135-0x0000000000000000-mapping.dmp

Download
memory/4880-142-0x0000000140000000-0x00000001407E1000-memory.dmp

Filesize
7.9MB

Download
memory/4880-143-0x00000001407DA9E0-mapping.dmp

Download
memory/4880-144-0x0000000140000000-0x00000001407E1000-memory.dmp

Filesize
7.9MB

Download
memory/4880-145-0x0000000140000000-0x00000001407E1000-memory.dmp

Filesize
7.9MB

Download
memory/4880-146-0x0000000140000000-0x00000001407E1000-memory.dmp

Filesize
7.9MB

Download
memory/4880-147-0x000002042EA10000-0x000002042EA30000-memory.dmp

Filesize
128KB

Download
memory/4880-148-0x000002042ED00000-0x000002042ED40000-memory.dmp

Filesize
256KB

Download
memory/4912-134-0x00007FF8767B0000-0x00007FF877271000-memory.dmp

Filesize
10.8MB

Download
memory/4912-132-0x000001CDED4E0000-0x000001CDED502000-memory.dmp

Filesize
136KB

Download
memory/4912-131-0x0000000000000000-mapping.dmp

Download
memory/4956-139-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4956-140-0x0000000000400000-mapping.dmp

Download
memory/4956-141-0x00007FF8767B0000-0x00007FF877271000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads