xmrig | e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3 | Triage

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 06:44

Sharing

Report Analysis Logs

General

Target

e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe
Size

5.7MB
MD5

e2251682527c703c5d204da5c74302fb
SHA1

24f7066fb21d3a85e92666a17cf6ccb27d8a9813
SHA256

e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3
SHA512

d5ca274a66e447cc6c69896c7e97fdc4dedd2d88b740d14c1a645184bbbafe447a66547e2e68f259543fac462cf09e000aa6df009f166b680609beffa04ebf39

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1764-54-0x000000013FE00000-0x000000014014D000-memory.dmp	xmrig

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

908 1764 WerFault.exe e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe

description	pid	process	target process
PID 1764 wrote to memory of 908	1764	e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe	WerFault.exe
PID 1764 wrote to memory of 908	1764	e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe	WerFault.exe
PID 1764 wrote to memory of 908	1764	e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe
"C:\Users\Admin\AppData\Local\Temp\e9d5e95e87fba83d3e43ebcbfccee53c185c39ca92b2d603bdf54b99016ec5f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1764 -s 72
2⤵
- Program crash
PID:908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-55-0x0000000000000000-mapping.dmp

Download
memory/1764-54-0x000000013FE00000-0x000000014014D000-memory.dmp

Filesize
3.3MB

Download