xmrig | fdbd17761ac4b2ec9b7a0abec20049da0f3ce045ea4feecc5c40243c9c3ea6eb

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

100852fe568182a47b154030590998eb.exe
Size

784KB
MD5

100852fe568182a47b154030590998eb
SHA1

ed6ef75222924feebe776ef98d4be0c4a96a4046
SHA256

fdbd17761ac4b2ec9b7a0abec20049da0f3ce045ea4feecc5c40243c9c3ea6eb
SHA512

d2380c49bc65f50882973494118586e3f7885e3091a5eef6f3fc19eafa56ed96a709fdea2939d8e93643c8dfac7fc531adb2e3bedfb7adc269461e50724fa71c
SSDEEP

12288:Rz/0/fS2mwcl2Ri/Vep5k93yAWP4Yl60EYnXKTNQ6DF+9JE2Cv8uK83B9:a/K2mdlKwVuIKT6vNxDFuJE3v8+3r

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2216-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2216-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/616-20-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/616-25-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/616-26-0x00000000030C0000-0x0000000003253000-memory.dmp	xmrig
behavioral1/memory/616-35-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/616-36-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
616	100852fe568182a47b154030590998eb.exe

Executes dropped EXE 1 IoCs

pid	Process
616	100852fe568182a47b154030590998eb.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	100852fe568182a47b154030590998eb.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000a000000012243-10.dat	upx
behavioral1/memory/2216-15-0x0000000003150000-0x0000000003462000-memory.dmp	upx
behavioral1/memory/616-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2216	100852fe568182a47b154030590998eb.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2216	100852fe568182a47b154030590998eb.exe
616	100852fe568182a47b154030590998eb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 616	2216	100852fe568182a47b154030590998eb.exe	29
PID 2216 wrote to memory of 616	2216	100852fe568182a47b154030590998eb.exe	29
PID 2216 wrote to memory of 616	2216	100852fe568182a47b154030590998eb.exe	29
PID 2216 wrote to memory of 616	2216	100852fe568182a47b154030590998eb.exe	29

C:\Users\Admin\AppData\Local\Temp\100852fe568182a47b154030590998eb.exe
"C:\Users\Admin\AppData\Local\Temp\100852fe568182a47b154030590998eb.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\100852fe568182a47b154030590998eb.exe
  C:\Users\Admin\AppData\Local\Temp\100852fe568182a47b154030590998eb.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\100852fe568182a47b154030590998eb.exe

Filesize
784KB

MD5
d05d22a5d0e11dd228f7f813825dae0b

SHA1
3f7fc6a87e43da898277bb2cae50d1b0aaf2ab88

SHA256
f7addb53d35221bf81c7c8be3576a3d1e3e2567117b6eaef6ff7fd5389c4bdc3

SHA512
6601cc86d5c73eb715b25aa9a14da31e7c87b5957397cd5824519164c670216ce4af8c3af8232c4f6c72180e37bb968f70bbf3f5c4f902c74bd13ce34e923319

Download Submit
memory/616-25-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/616-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/616-19-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/616-20-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/616-26-0x00000000030C0000-0x0000000003253000-memory.dmp

Filesize
1.6MB

Download
memory/616-35-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/616-36-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2216-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2216-2-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2216-15-0x0000000003150000-0x0000000003462000-memory.dmp

Filesize
3.1MB

Download
memory/2216-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2216-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download