xmrig | a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e

General

Target

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe
Size

2.4MB
MD5

05e5b7a1ba45c36e63bb4bc1d39874c9
SHA1

db184def60fb765dd0c14db6d77661611011c097
SHA256

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e
SHA512

979ece9f909d9b7c299d688cd6aa9997f33c6bd5660f082e976df92797359709bf6c4b199d6429b31edcd8bf3d7d45696f3e534fac537ce1f441322d1fd15ade

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3452-138-0x00000000004E78B0-mapping.dmp	xmrig
behavioral2/memory/3452-141-0x0000000000400000-0x00000000004ED000-memory.dmp	xmrig
behavioral2/memory/3452-144-0x0000000000400000-0x00000000004ED000-memory.dmp	xmrig

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3452-137-0x0000000000400000-0x00000000004ED000-memory.dmp	upx
behavioral2/memory/3452-139-0x0000000000400000-0x00000000004ED000-memory.dmp	upx
behavioral2/memory/3452-140-0x0000000000400000-0x00000000004ED000-memory.dmp	upx
behavioral2/memory/3452-141-0x0000000000400000-0x00000000004ED000-memory.dmp	upx
behavioral2/memory/3452-144-0x0000000000400000-0x00000000004ED000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

notepad.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TiDxYXjUUK = "\"C:\\Users\\Admin\\AppData\\Local\\MUUEQU~1\\javaxp.exe\""	notepad.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exenotepad.exe

description	pid	process	target process
PID 1496 set thread context of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 952 set thread context of 3452	952	notepad.exe	notepad.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

Modifies registry class 2 IoCs

Processes:

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rh1556396373q.ysg	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\rh1556396373q.ysg\ = aa0bc406b686c63c9706e725125616d4	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

notepad.exe

pid	process
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe
952	notepad.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

notepad.exenotepad.exe

description pid process

Token: SeDebugPrivilege 952 notepad.exe
Token: SeLockMemoryPrivilege 3452 notepad.exe
Token: SeLockMemoryPrivilege 3452 notepad.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

pid process

1496 a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

description	pid	process
Token: SeDebugPrivilege	952	notepad.exe
Token: SeLockMemoryPrivilege	3452	notepad.exe
Token: SeLockMemoryPrivilege	3452	notepad.exe

pid	process
1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exenotepad.exe

description	pid	process	target process
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 1496 wrote to memory of 952	1496	a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe
PID 952 wrote to memory of 3452	952	notepad.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe
"C:\Users\Admin\AppData\Local\Temp\a36430851072c9ef0330d0fa58f5f777983f20a2b7415733e2a62f092429d67e.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\muuEquuwjW\cfgi"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\muuEquuwjW\cfgi
Filesize
550B

MD5
ecf7d1daa62b857e40a493f631724288

SHA1
64b3b1fe9f5ba2373a29a5fb65c48a01dda0d368

SHA256
df7a381eb21a2b0045bba660c9af597157e07c202a49446a166894ec6f214a69

SHA512
042eb8e953188ca9b574e1f14d1bc95aaa643ca7d31bf6ba7b10fa97964332ff6a0b97a90d8199ed99eece61d8c47c08f0af9ccfdb67c4d25c4931fd03c970e6

Download Submit
memory/952-133-0x0000000000000000-mapping.dmp

Download
memory/952-134-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/952-136-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/952-142-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1496-132-0x0000000000400000-0x0000000000769000-memory.dmp

Filesize
3.4MB

Download
memory/3452-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3452-138-0x00000000004E78B0-mapping.dmp

Download
memory/3452-139-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3452-140-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3452-141-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3452-144-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads