xmrig | 0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

Analysis

max time kernel
80s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
Size

5.2MB
MD5

0e9cc5c2145bae2f6ab41f186dac87d1
SHA1

3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA256

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA512

76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
SSDEEP

98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

Processes:

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exeupdater.exe

description	pid	Process	procid_target
PID 3608 created 3132	3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe	40
PID 3608 created 3132	3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe	40
PID 3608 created 3132	3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe	40
PID 4032 created 3132	4032	updater.exe	40
PID 4032 created 3132	4032	updater.exe	40
PID 4032 created 3132	4032	updater.exe	40
PID 4032 created 3132	4032	updater.exe	40

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4032-10-0x00007FF6A3920000-0x00007FF6A3E51000-memory.dmp	xmrig
behavioral2/memory/4192-21-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-22-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-26-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-27-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-28-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-29-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-30-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-31-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-32-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-33-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-36-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-37-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-38-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-41-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-42-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-43-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-44-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-45-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-46-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-47-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-48-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-49-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-50-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig
behavioral2/memory/448-51-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp	xmrig
behavioral2/memory/4192-52-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp	xmrig
behavioral2/memory/2596-53-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

Processes:

updater.exe

pid	Process
4032	updater.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

updater.exe

description	pid	Process	procid_target
PID 4032 set thread context of 4192	4032	updater.exe	106
PID 4032 set thread context of 2596	4032	updater.exe	107
PID 4032 set thread context of 448	4032	updater.exe	108

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
4512	schtasks.exe
544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exeupdater.exe

pid	Process
3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
3608	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
4032	updater.exe
4032	updater.exe
4032	updater.exe
4032	updater.exe
4032	updater.exe
4032	updater.exe
4032	updater.exe
4032	updater.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid	Process
652
652

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exe

description	pid	Process
Token: SeLockMemoryPrivilege	4192	explorer.exe
Token: SeLockMemoryPrivilege	4192	explorer.exe
Token: SeLockMemoryPrivilege	2596	explorer.exe
Token: SeLockMemoryPrivilege	2596	explorer.exe
Token: SeLockMemoryPrivilege	448	explorer.exe
Token: SeLockMemoryPrivilege	448	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

updater.exe

description	pid	Process	procid_target
PID 4032 wrote to memory of 4192	4032	updater.exe	106
PID 4032 wrote to memory of 2596	4032	updater.exe	107
PID 4032 wrote to memory of 448	4032	updater.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3132
- C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
  "C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:1476
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4512
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4080
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:544
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:448

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
0e9cc5c2145bae2f6ab41f186dac87d1

SHA1
3a495afddc1ed60ecc5c403a6e9dcdc53516ca35

SHA256
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

SHA512
76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb

Download Submit
memory/448-26-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-37-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-42-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-54-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-45-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-51-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-32-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-29-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/448-48-0x00007FF788F80000-0x00007FF7897C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-24-0x0000000013800000-0x0000000013820000-memory.dmp

Filesize
128KB

Download
memory/2596-17-0x0000000013A30000-0x0000000013A50000-memory.dmp

Filesize
128KB

Download
memory/2596-41-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-25-0x0000000013A30000-0x0000000013A50000-memory.dmp

Filesize
128KB

Download
memory/2596-50-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-36-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-28-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-22-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-47-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-31-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-16-0x0000000013800000-0x0000000013820000-memory.dmp

Filesize
128KB

Download
memory/2596-53-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-44-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/2596-56-0x00007FF67F980000-0x00007FF6801C0000-memory.dmp

Filesize
8.2MB

Download
memory/3608-0-0x00007FF6CD080000-0x00007FF6CD5B1000-memory.dmp

Filesize
5.2MB

Download
memory/3608-4-0x00007FF6CD080000-0x00007FF6CD5B1000-memory.dmp

Filesize
5.2MB

Download
memory/4032-20-0x00007FF6A3920000-0x00007FF6A3E51000-memory.dmp

Filesize
5.2MB

Download
memory/4032-10-0x00007FF6A3920000-0x00007FF6A3E51000-memory.dmp

Filesize
5.2MB

Download
memory/4032-6-0x00007FF6A3920000-0x00007FF6A3E51000-memory.dmp

Filesize
5.2MB

Download
memory/4192-30-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-27-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-43-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-34-0x0000000002A90000-0x0000000002AB0000-memory.dmp

Filesize
128KB

Download
memory/4192-33-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-46-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-39-0x0000000002A90000-0x0000000002AB0000-memory.dmp

Filesize
128KB

Download
memory/4192-35-0x00000000137C0000-0x00000000137E0000-memory.dmp

Filesize
128KB

Download
memory/4192-49-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-21-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-15-0x0000000013050000-0x0000000013090000-memory.dmp

Filesize
256KB

Download
memory/4192-52-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-12-0x0000000000BE0000-0x0000000000C00000-memory.dmp

Filesize
128KB

Download
memory/4192-38-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-55-0x00007FF69DFA0000-0x00007FF69E7E0000-memory.dmp

Filesize
8.2MB

Download
memory/4192-40-0x00000000137C0000-0x00000000137E0000-memory.dmp

Filesize
128KB

Download