xmrig | c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c

General

Target

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
Size

993KB
MD5

251e591c32e05db298f18ed3e1dd46ed
SHA1

958d85866b52c25c7ccb49132ae0b2a719ed9379
SHA256

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c
SHA512

b769e658f7e4ca8569d0fe51f184379c88cc62576da04ae249ed860bb653a58857a3bc0a58c472ca791d3b8ab13eb8c05c7a58115ec9c331ea96d0710fe4bb58

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1704-61-0x0000000000400000-0x0000000000516000-memory.dmp	xmrig
behavioral1/memory/1704-63-0x0000000000400000-0x0000000000516000-memory.dmp	xmrig
behavioral1/memory/1704-64-0x0000000000400000-0x0000000000516000-memory.dmp	xmrig

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1704-57-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1704-59-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1704-60-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1704-61-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1704-63-0x0000000000400000-0x0000000000516000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BfWTjSzBAA.url	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe

description	pid	process	target process
PID 1904 set thread context of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe

pid	process
1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exenotepad.exe

description	pid	process
Token: SeDebugPrivilege	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
Token: SeLockMemoryPrivilege	1704	notepad.exe
Token: SeLockMemoryPrivilege	1704	notepad.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe

description	pid	process	target process
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe
PID 1904 wrote to memory of 1704	1904	c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe
"C:\Users\Admin\AppData\Local\Temp\c397e28d15389c02c117483f933807324cb14b2cbe683e4310ae3d844fb9319c.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\WrdJdgYRmg\cfgi"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WrdJdgYRmg\cfgi
Filesize
505B

MD5
64d505c2b4dea72103363f10025a4a3b

SHA1
780f106e13169b67851128682c8fe6d5446a71ca

SHA256
723fa485776c9f37d5d696b11e997bec11861d1965888ca0b36ac1d0bc26acc4

SHA512
e0b7c081f9f817b2725b27b1251877d6d3c96e50bd987e98d476ea941822f441f6e664862eddedad6cbf06d2c1bc9b8c19d60353495d485c789186d6c9bbc510

Download Submit
memory/1704-58-0x000000000050F100-mapping.dmp

Download
memory/1704-57-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1704-59-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1704-60-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1704-61-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1704-63-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1704-64-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1904-54-0x00000000768F1000-0x00000000768F3000-memory.dmp

Filesize
8KB

Download
memory/1904-55-0x0000000001CF0000-0x0000000001DC0000-memory.dmp

Filesize
832KB

Download
memory/1904-56-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads