Overview

overview

10

Static

static

8

54b803e59c...cf.exe

windows7_x64

10

54b803e59c...cf.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    171s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 03:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54b803e59c04d3b88b1a6e8e2ff3ad65cddcaa164733b67319a897b974a926cf.exe

  • Size

    1.1MB

  • MD5

    095cb62a0daf1fea377ab60917a24b67

  • SHA1

    5a3cd2b24201a7cf6a98d6f1a06aa984dfed0e8c

  • SHA256

    54b803e59c04d3b88b1a6e8e2ff3ad65cddcaa164733b67319a897b974a926cf

  • SHA512

    55194c0e738f3872ea1fb8a64881f6265ea9ec2bff2dbd722166283ac93a12fb85077aaf9b7ca075d69d58d2467460b1d7ab715f86796e8ec09df62980487d80

Score
10/10
xmrigminerpersistenceupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • XMRig Miner Payload 16 IoCs
    miner
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54b803e59c04d3b88b1a6e8e2ff3ad65cddcaa164733b67319a897b974a926cf.exe
    "C:\Users\Admin\AppData\Local\Temp\54b803e59c04d3b88b1a6e8e2ff3ad65cddcaa164733b67319a897b974a926cf.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\SysWOW64\svchost.exe
      -o xmr.pool.minergate.com:45560 -u mikaelamonero2@gmx.com -p x --max-cpu-usage=20 --donate-level=1 -k -B
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:912
    • C:\Windows\SysWOW64\calc.exe
      -o xmr.pool.minergate.com:45560 -u thiagoiphones6@gmail.com -p x --max-cpu-usage=50 --donate-level=1 -k -B
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1808
    • C:\Windows\SysWOW64\svchost.exe
      -o xmr.pool.minergate.com:45560 -u mikaelamonero2@gmx.com -p x --max-cpu-usage=20 --donate-level=1 -k -B
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
    • C:\Windows\SysWOW64\calc.exe
      -o xmr.pool.minergate.com:45560 -u thiagoiphones6@gmail.com -p x --max-cpu-usage=50 --donate-level=1 -k -B
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\LZMA.DLL
    Filesize

    22KB

    MD5

    ccf916511374fa95c4c685ee0854fe9e

    SHA1

    27d7458ecafb17c202d262c990bd06f4d47098bd

    SHA256

    2a6b997d31834bd186e6ed19651b33bda29260ba09a17a78c6e81dfbc6b299de

    SHA512

    db90ddfb847192fd4736278d48ef31629e8e01e03f92e5c3c262963a2207b7f750d9200fa5f7904d659d3ebb3dd45cebd5a54779395da24a56ea8a3bc1923cad

    Download Submit
  • \Users\Admin\AppData\Local\Temp\LZMA.DLL
    Filesize

    22KB

    MD5

    ccf916511374fa95c4c685ee0854fe9e

    SHA1

    27d7458ecafb17c202d262c990bd06f4d47098bd

    SHA256

    2a6b997d31834bd186e6ed19651b33bda29260ba09a17a78c6e81dfbc6b299de

    SHA512

    db90ddfb847192fd4736278d48ef31629e8e01e03f92e5c3c262963a2207b7f750d9200fa5f7904d659d3ebb3dd45cebd5a54779395da24a56ea8a3bc1923cad

    Download Submit
  • \Users\Admin\AppData\Local\Temp\LZMA.DLL
    Filesize

    22KB

    MD5

    ccf916511374fa95c4c685ee0854fe9e

    SHA1

    27d7458ecafb17c202d262c990bd06f4d47098bd

    SHA256

    2a6b997d31834bd186e6ed19651b33bda29260ba09a17a78c6e81dfbc6b299de

    SHA512

    db90ddfb847192fd4736278d48ef31629e8e01e03f92e5c3c262963a2207b7f750d9200fa5f7904d659d3ebb3dd45cebd5a54779395da24a56ea8a3bc1923cad

    Download Submit
  • \Users\Admin\AppData\Local\Temp\LZMA.DLL
    Filesize

    22KB

    MD5

    ccf916511374fa95c4c685ee0854fe9e

    SHA1

    27d7458ecafb17c202d262c990bd06f4d47098bd

    SHA256

    2a6b997d31834bd186e6ed19651b33bda29260ba09a17a78c6e81dfbc6b299de

    SHA512

    db90ddfb847192fd4736278d48ef31629e8e01e03f92e5c3c262963a2207b7f750d9200fa5f7904d659d3ebb3dd45cebd5a54779395da24a56ea8a3bc1923cad

    Download Submit
  • memory/912-60-0x0000000000081500-mapping.dmp
    Download
  • memory/912-81-0x0000000000080000-0x0000000000183000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/912-62-0x0000000000080000-0x0000000000183000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/912-57-0x0000000000080000-0x0000000000183000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/912-59-0x0000000000080000-0x0000000000183000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1112-85-0x00000000002C0000-0x00000000003C3000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1112-73-0x00000000002C0000-0x00000000003C3000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1112-74-0x00000000002C1500-mapping.dmp
    Download
  • memory/1112-78-0x00000000002C0000-0x00000000003C3000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1120-54-0x00000000753B1000-0x00000000753B3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1808-65-0x0000000000140000-0x0000000000243000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1808-72-0x0000000000140000-0x0000000000243000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1808-66-0x0000000000141500-mapping.dmp
    Download
  • memory/1808-83-0x0000000000140000-0x0000000000243000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1824-79-0x0000000000250000-0x0000000000353000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1824-84-0x0000000000250000-0x0000000000353000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1824-80-0x0000000000251500-mapping.dmp
    Download
  • memory/1824-86-0x0000000000250000-0x0000000000353000-memory.dmp
    Filesize

    1.0MB

    Download