xmrig | 0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

Analysis

max time kernel
176s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

5.2MB
MD5

0e9cc5c2145bae2f6ab41f186dac87d1
SHA1

3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA256

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA512

76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
SSDEEP

98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 4460 created 3120	4460	tmp.exe	26
PID 4460 created 3120	4460	tmp.exe	26
PID 4460 created 3120	4460	tmp.exe	26
PID 928 created 3120	928	updater.exe	26
PID 928 created 3120	928	updater.exe	26
PID 928 created 3120	928	updater.exe	26
PID 928 created 3120	928	updater.exe	26

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral2/memory/928-11-0x00007FF653E80000-0x00007FF6543B1000-memory.dmp	xmrig
behavioral2/memory/1136-20-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/1424-22-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-23-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/1424-30-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-31-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/4872-32-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp	xmrig
behavioral2/memory/1424-33-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-34-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/4872-35-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp	xmrig
behavioral2/memory/1424-36-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-37-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/4872-38-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp	xmrig
behavioral2/memory/1424-40-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-42-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/4872-43-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp	xmrig
behavioral2/memory/1424-44-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-47-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/4872-52-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp	xmrig
behavioral2/memory/1424-53-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-54-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig
behavioral2/memory/4872-59-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp	xmrig
behavioral2/memory/1424-60-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp	xmrig
behavioral2/memory/1136-61-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
928	updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 928 set thread context of 1136	928	updater.exe	99
PID 928 set thread context of 1424	928	updater.exe	103
PID 928 set thread context of 4872	928	updater.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4900	schtasks.exe
832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4460	tmp.exe
4460	tmp.exe
4460	tmp.exe
4460	tmp.exe
4460	tmp.exe
4460	tmp.exe
928	updater.exe
928	updater.exe
928	updater.exe
928	updater.exe
928	updater.exe
928	updater.exe
928	updater.exe
928	updater.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1136	explorer.exe
Token: SeLockMemoryPrivilege	1136	explorer.exe
Token: SeLockMemoryPrivilege	1424	explorer.exe
Token: SeLockMemoryPrivilege	1424	explorer.exe
Token: SeLockMemoryPrivilege	4872	explorer.exe
Token: SeLockMemoryPrivilege	4872	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1136	928	updater.exe	99
PID 928 wrote to memory of 1424	928	updater.exe	103
PID 928 wrote to memory of 4872	928	updater.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3120
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3624
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4900
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2764
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:832
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4872

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
0e9cc5c2145bae2f6ab41f186dac87d1

SHA1
3a495afddc1ed60ecc5c403a6e9dcdc53516ca35

SHA256
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

SHA512
76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb

Download Submit
memory/928-28-0x00007FF653E80000-0x00007FF6543B1000-memory.dmp

Filesize
5.2MB

Download
memory/928-11-0x00007FF653E80000-0x00007FF6543B1000-memory.dmp

Filesize
5.2MB

Download
memory/928-7-0x00007FF653E80000-0x00007FF6543B1000-memory.dmp

Filesize
5.2MB

Download
memory/1136-47-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-45-0x00000000139B0000-0x00000000139D0000-memory.dmp

Filesize
128KB

Download
memory/1136-13-0x0000000000FD0000-0x0000000000FF0000-memory.dmp

Filesize
128KB

Download
memory/1136-17-0x0000000013440000-0x0000000013480000-memory.dmp

Filesize
256KB

Download
memory/1136-34-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-46-0x0000000013BE0000-0x0000000013C00000-memory.dmp

Filesize
128KB

Download
memory/1136-20-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-54-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-42-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-23-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-41-0x0000000013BE0000-0x0000000013C00000-memory.dmp

Filesize
128KB

Download
memory/1136-61-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-39-0x00000000139B0000-0x00000000139D0000-memory.dmp

Filesize
128KB

Download
memory/1136-31-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1136-37-0x00007FF7EF1A0000-0x00007FF7EF9E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-18-0x0000000012E10000-0x0000000012E30000-memory.dmp

Filesize
128KB

Download
memory/1424-44-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-60-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-36-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-53-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-19-0x0000000013040000-0x0000000013060000-memory.dmp

Filesize
128KB

Download
memory/1424-30-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-40-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-25-0x0000000013040000-0x0000000013060000-memory.dmp

Filesize
128KB

Download
memory/1424-24-0x0000000012E10000-0x0000000012E30000-memory.dmp

Filesize
128KB

Download
memory/1424-22-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/1424-33-0x00007FF6210A0000-0x00007FF6218E0000-memory.dmp

Filesize
8.2MB

Download
memory/4460-0-0x00007FF729940000-0x00007FF729E71000-memory.dmp

Filesize
5.2MB

Download
memory/4460-5-0x00007FF729940000-0x00007FF729E71000-memory.dmp

Filesize
5.2MB

Download
memory/4460-1-0x00007FF729940000-0x00007FF729E71000-memory.dmp

Filesize
5.2MB

Download
memory/4872-43-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp

Filesize
8.2MB

Download
memory/4872-38-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp

Filesize
8.2MB

Download
memory/4872-52-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp

Filesize
8.2MB

Download
memory/4872-32-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp

Filesize
8.2MB

Download
memory/4872-59-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp

Filesize
8.2MB

Download
memory/4872-35-0x00007FF724C90000-0x00007FF7254D0000-memory.dmp

Filesize
8.2MB

Download