xmrig | 0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

Analysis

max time kernel
99s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e9cc5c2145bae2f6ab41f186dac87d1.exe
Size

5.2MB
MD5

0e9cc5c2145bae2f6ab41f186dac87d1
SHA1

3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA256

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA512

76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
SSDEEP

98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 3708 created 3152	3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe	55
PID 3708 created 3152	3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe	55
PID 3708 created 3152	3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe	55
PID 4748 created 3152	4748	updater.exe	55
PID 4748 created 3152	4748	updater.exe	55
PID 4748 created 3152	4748	updater.exe	55
PID 4748 created 3152	4748	updater.exe	55

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/4748-17-0x00007FF73ED70000-0x00007FF73F2A1000-memory.dmp	xmrig
behavioral2/memory/1688-20-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-21-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-26-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-27-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-28-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-29-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-30-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-31-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-32-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-33-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-34-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-35-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-36-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-37-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-38-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-39-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-40-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-41-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-42-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-43-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-44-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-45-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-46-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-47-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-48-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-49-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-50-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-55-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-56-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-57-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig
behavioral2/memory/1688-58-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp	xmrig
behavioral2/memory/1624-59-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp	xmrig
behavioral2/memory/2688-60-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
4748	updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 1688	4748	updater.exe	102
PID 4748 set thread context of 1624	4748	updater.exe	103
PID 4748 set thread context of 2688	4748	updater.exe	104

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4116	schtasks.exe
2348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe
3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe
3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe
3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe
3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe
3708	0e9cc5c2145bae2f6ab41f186dac87d1.exe
4748	updater.exe
4748	updater.exe
4748	updater.exe
4748	updater.exe
4748	updater.exe
4748	updater.exe
4748	updater.exe
4748	updater.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1688	explorer.exe
Token: SeLockMemoryPrivilege	1688	explorer.exe
Token: SeLockMemoryPrivilege	1624	explorer.exe
Token: SeLockMemoryPrivilege	1624	explorer.exe
Token: SeLockMemoryPrivilege	2688	explorer.exe
Token: SeLockMemoryPrivilege	2688	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1688	4748	updater.exe	102
PID 4748 wrote to memory of 1624	4748	updater.exe	103
PID 4748 wrote to memory of 2688	4748	updater.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3152
- C:\Users\Admin\AppData\Local\Temp\0e9cc5c2145bae2f6ab41f186dac87d1.exe
  "C:\Users\Admin\AppData\Local\Temp\0e9cc5c2145bae2f6ab41f186dac87d1.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3608
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4116
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4704
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2348
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
0e9cc5c2145bae2f6ab41f186dac87d1

SHA1
3a495afddc1ed60ecc5c403a6e9dcdc53516ca35

SHA256
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

SHA512
76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb

Download Submit
memory/1624-46-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-59-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-56-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-49-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-43-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-15-0x00000000024C0000-0x00000000024E0000-memory.dmp

Filesize
128KB

Download
memory/1624-16-0x00000000024E0000-0x0000000002500000-memory.dmp

Filesize
128KB

Download
memory/1624-40-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-34-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-31-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-21-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-23-0x00000000024C0000-0x00000000024E0000-memory.dmp

Filesize
128KB

Download
memory/1624-24-0x00000000024E0000-0x0000000002500000-memory.dmp

Filesize
128KB

Download
memory/1624-37-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1624-28-0x00007FF60FA70000-0x00007FF6102B0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-14-0x00000000025F0000-0x0000000002630000-memory.dmp

Filesize
256KB

Download
memory/1688-42-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-36-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-58-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-55-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-33-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-20-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-11-0x00000000025C0000-0x00000000025E0000-memory.dmp

Filesize
128KB

Download
memory/1688-48-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-30-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-45-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-39-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/1688-27-0x00007FF7C6D60000-0x00007FF7C75A0000-memory.dmp

Filesize
8.2MB

Download
memory/2688-60-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-57-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-41-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-44-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-38-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-26-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-47-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-29-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-35-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-50-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/2688-52-0x00007FFA501D0000-0x00007FFA50262000-memory.dmp

Filesize
584KB

Download
memory/2688-32-0x00007FF60CBF0000-0x00007FF60D430000-memory.dmp

Filesize
8.2MB

Download
memory/3708-4-0x00007FF7DD5F0000-0x00007FF7DDB21000-memory.dmp

Filesize
5.2MB

Download
memory/3708-0-0x00007FF7DD5F0000-0x00007FF7DDB21000-memory.dmp

Filesize
5.2MB

Download
memory/4748-6-0x00007FF73ED70000-0x00007FF73F2A1000-memory.dmp

Filesize
5.2MB

Download
memory/4748-22-0x00007FF73ED70000-0x00007FF73F2A1000-memory.dmp

Filesize
5.2MB

Download
memory/4748-17-0x00007FF73ED70000-0x00007FF73F2A1000-memory.dmp

Filesize
5.2MB

Download