xmrig | 0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

Analysis

max time kernel
119s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
Size

5.2MB
MD5

0e9cc5c2145bae2f6ab41f186dac87d1
SHA1

3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA256

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA512

76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
SSDEEP

98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 4304 created 3164	4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe	38
PID 4304 created 3164	4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe	38
PID 4304 created 3164	4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe	38
PID 2292 created 3164	2292	updater.exe	38
PID 2292 created 3164	2292	updater.exe	38
PID 2292 created 3164	2292	updater.exe	38
PID 2292 created 3164	2292	updater.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral2/memory/4688-20-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-21-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-22-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-25-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-26-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-27-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-28-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-29-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-30-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-31-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-32-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-33-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-34-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-35-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-36-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-39-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-40-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-41-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-44-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-45-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-46-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-47-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-52-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-53-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-54-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-55-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-56-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig
behavioral2/memory/4688-61-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp	xmrig
behavioral2/memory/1632-62-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp	xmrig
behavioral2/memory/1420-63-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
2292	updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 4688	2292	updater.exe	100
PID 2292 set thread context of 1632	2292	updater.exe	101
PID 2292 set thread context of 1420	2292	updater.exe	102

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4912	schtasks.exe
1116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
4304	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
2292	updater.exe
2292	updater.exe
2292	updater.exe
2292	updater.exe
2292	updater.exe
2292	updater.exe
2292	updater.exe
2292	updater.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4688	explorer.exe
Token: SeLockMemoryPrivilege	1632	explorer.exe
Token: SeLockMemoryPrivilege	1632	explorer.exe
Token: SeLockMemoryPrivilege	4688	explorer.exe
Token: SeLockMemoryPrivilege	1420	explorer.exe
Token: SeLockMemoryPrivilege	1420	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4688	2292	updater.exe	100
PID 2292 wrote to memory of 1632	2292	updater.exe	101
PID 2292 wrote to memory of 1420	2292	updater.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3164
- C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8_JC.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4144
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4912
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3664
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1116
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1420

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
0e9cc5c2145bae2f6ab41f186dac87d1

SHA1
3a495afddc1ed60ecc5c403a6e9dcdc53516ca35

SHA256
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

SHA512
76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb

Download Submit
memory/1420-56-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-63-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-66-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-27-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-53-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-46-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-41-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-36-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-33-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-30-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1420-22-0x00007FF7FCA90000-0x00007FF7FD2D0000-memory.dmp

Filesize
8.2MB

Download
memory/1632-32-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-55-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-65-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-26-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-62-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-52-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-29-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-21-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-17-0x0000000012DA0000-0x0000000012DE0000-memory.dmp

Filesize
256KB

Download
memory/1632-45-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-42-0x00000000135A0000-0x00000000135C0000-memory.dmp

Filesize
128KB

Download
memory/1632-43-0x00000000137D0000-0x00000000137F0000-memory.dmp

Filesize
128KB

Download
memory/1632-35-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-40-0x00007FF79F940000-0x00007FF7A0180000-memory.dmp

Filesize
8.2MB

Download
memory/1632-38-0x00000000137D0000-0x00000000137F0000-memory.dmp

Filesize
128KB

Download
memory/1632-37-0x00000000135A0000-0x00000000135C0000-memory.dmp

Filesize
128KB

Download
memory/2292-6-0x00007FF704280000-0x00007FF7047B1000-memory.dmp

Filesize
5.2MB

Download
memory/2292-15-0x00007FF704280000-0x00007FF7047B1000-memory.dmp

Filesize
5.2MB

Download
memory/4304-0-0x00007FF701770000-0x00007FF701CA1000-memory.dmp

Filesize
5.2MB

Download
memory/4304-4-0x00007FF701770000-0x00007FF701CA1000-memory.dmp

Filesize
5.2MB

Download
memory/4688-44-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-11-0x0000000002230000-0x0000000002250000-memory.dmp

Filesize
128KB

Download
memory/4688-20-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-31-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-47-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-28-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-34-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-54-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-24-0x0000000013090000-0x00000000130B0000-memory.dmp

Filesize
128KB

Download
memory/4688-39-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-61-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-23-0x0000000012E60000-0x0000000012E80000-memory.dmp

Filesize
128KB

Download
memory/4688-18-0x0000000012E60000-0x0000000012E80000-memory.dmp

Filesize
128KB

Download
memory/4688-64-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-25-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download
memory/4688-19-0x0000000013090000-0x00000000130B0000-memory.dmp

Filesize
128KB

Download
memory/4688-67-0x00007FF66E540000-0x00007FF66ED80000-memory.dmp

Filesize
8.2MB

Download