xmrig | 0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

Analysis

max time kernel
100s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2023, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

5.2MB
MD5

0e9cc5c2145bae2f6ab41f186dac87d1
SHA1

3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA256

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA512

76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
SSDEEP

98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 1656 created 3184	1656	tmp.exe	45
PID 1656 created 3184	1656	tmp.exe	45
PID 1656 created 3184	1656	tmp.exe	45
PID 772 created 3184	772	updater.exe	45
PID 772 created 3184	772	updater.exe	45
PID 772 created 3184	772	updater.exe	45
PID 772 created 3184	772	updater.exe	45

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/772-17-0x00007FF7F3780000-0x00007FF7F3CB1000-memory.dmp	xmrig
behavioral2/memory/2180-20-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-21-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-26-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-27-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-28-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-29-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-30-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-31-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-34-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-35-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-36-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-39-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-40-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-41-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-42-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-43-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-44-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-45-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-46-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-47-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-48-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-49-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-50-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-51-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-52-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-53-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-54-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-55-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-56-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-57-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig
behavioral2/memory/2180-58-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp	xmrig
behavioral2/memory/4168-59-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp	xmrig
behavioral2/memory/2552-60-0x00007FF691530000-0x00007FF691D70000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
772	updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 2180	772	updater.exe	109
PID 772 set thread context of 4168	772	updater.exe	110
PID 772 set thread context of 2552	772	updater.exe	111

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3860	schtasks.exe
4400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1656	tmp.exe
1656	tmp.exe
1656	tmp.exe
1656	tmp.exe
1656	tmp.exe
1656	tmp.exe
772	updater.exe
772	updater.exe
772	updater.exe
772	updater.exe
772	updater.exe
772	updater.exe
772	updater.exe
772	updater.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2180	explorer.exe
Token: SeLockMemoryPrivilege	2180	explorer.exe
Token: SeLockMemoryPrivilege	4168	explorer.exe
Token: SeLockMemoryPrivilege	4168	explorer.exe
Token: SeLockMemoryPrivilege	2552	explorer.exe
Token: SeLockMemoryPrivilege	2552	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2180	772	updater.exe	109
PID 772 wrote to memory of 4168	772	updater.exe	110
PID 772 wrote to memory of 2552	772	updater.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3184
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3180
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:3860
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4504
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4400
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2552

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
0e9cc5c2145bae2f6ab41f186dac87d1

SHA1
3a495afddc1ed60ecc5c403a6e9dcdc53516ca35

SHA256
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

SHA512
76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb

Download Submit
memory/772-17-0x00007FF7F3780000-0x00007FF7F3CB1000-memory.dmp

Filesize
5.2MB

Download
memory/772-6-0x00007FF7F3780000-0x00007FF7F3CB1000-memory.dmp

Filesize
5.2MB

Download
memory/772-22-0x00007FF7F3780000-0x00007FF7F3CB1000-memory.dmp

Filesize
5.2MB

Download
memory/1656-4-0x00007FF639E60000-0x00007FF63A391000-memory.dmp

Filesize
5.2MB

Download
memory/1656-0-0x00007FF639E60000-0x00007FF63A391000-memory.dmp

Filesize
5.2MB

Download
memory/2180-35-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-11-0x0000000002010000-0x0000000002030000-memory.dmp

Filesize
128KB

Download
memory/2180-58-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-20-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-55-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-14-0x00000000020B0000-0x00000000020F0000-memory.dmp

Filesize
256KB

Download
memory/2180-52-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-49-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-46-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-27-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-43-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-40-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-30-0x00007FF77A2F0000-0x00007FF77AB30000-memory.dmp

Filesize
8.2MB

Download
memory/2180-38-0x0000000012E40000-0x0000000012E60000-memory.dmp

Filesize
128KB

Download
memory/2180-32-0x0000000012C10000-0x0000000012C30000-memory.dmp

Filesize
128KB

Download
memory/2180-33-0x0000000012E40000-0x0000000012E60000-memory.dmp

Filesize
128KB

Download
memory/2180-37-0x0000000012C10000-0x0000000012C30000-memory.dmp

Filesize
128KB

Download
memory/2552-29-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-48-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-34-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-60-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-39-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-57-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-54-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-42-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-51-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-26-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/2552-45-0x00007FF691530000-0x00007FF691D70000-memory.dmp

Filesize
8.2MB

Download
memory/4168-23-0x0000000012C20000-0x0000000012C40000-memory.dmp

Filesize
128KB

Download
memory/4168-56-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-36-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-24-0x0000000012E50000-0x0000000012E70000-memory.dmp

Filesize
128KB

Download
memory/4168-50-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-28-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-47-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-41-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-44-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-21-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-53-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-16-0x0000000012E50000-0x0000000012E70000-memory.dmp

Filesize
128KB

Download
memory/4168-15-0x0000000012C20000-0x0000000012C40000-memory.dmp

Filesize
128KB

Download
memory/4168-59-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download
memory/4168-31-0x00007FF69EC20000-0x00007FF69F460000-memory.dmp

Filesize
8.2MB

Download