xmrig | 8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6 | Triage

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 04:53

Sharing

Report Analysis Logs

General

Target

8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe
Size

5.7MB
MD5

e3896333e7fd0ee95b7526a0c82a3d3d
SHA1

f3c86bea146a8c86c9eae9d51b274bec41187941
SHA256

8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6
SHA512

49b22509b9c1e133d054c6a0363661cd3738b6315c45fb9246eae6e59f9dccd843e0bd802b8522fac95576d32baeda4953ae050c60f0ad90ee91f71c0c684cf1

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1496-54-0x000000013FD90000-0x00000001400DD000-memory.dmp	xmrig

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1496 WerFault.exe 8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe

description	pid	process	target process
PID 1496 wrote to memory of 952	1496	8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe	WerFault.exe
PID 1496 wrote to memory of 952	1496	8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe	WerFault.exe
PID 1496 wrote to memory of 952	1496	8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe
"C:\Users\Admin\AppData\Local\Temp\8d62e0b3a26421b7a9ffc6f2fe6d56fb6c2c770811a7059585376108de0794e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1496 -s 72
2⤵
- Program crash
PID:952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-55-0x0000000000000000-mapping.dmp

Download
memory/1496-54-0x000000013FD90000-0x00000001400DD000-memory.dmp

Filesize
3.3MB

Download