xmrig | 713be6d900c555cbd5b338109ea64d99aa2801b9ec51646c73eeeeb74145d61b

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aa37ab18bc6dcfb45b32b7047097884.exe
Size

784KB
MD5

0aa37ab18bc6dcfb45b32b7047097884
SHA1

6acbd188621580c44fa96ebc03b1a67a8c914163
SHA256

713be6d900c555cbd5b338109ea64d99aa2801b9ec51646c73eeeeb74145d61b
SHA512

eb6748d3d207d004719694bf46dbab8def1d256609677a66a688435cef10e304b30482ee5a0a9b2d774efca300c3ff2b31c6bcaf95212dbe784b92f4fc531c66
SSDEEP

24576:r9kq38MC1m7G+2+sw+MS0NsA1Umazx7v7:rM1mgbnM5scUFzlv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3688-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3688-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1844-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1844-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1844-20-0x0000000005580000-0x0000000005713000-memory.dmp	xmrig
behavioral2/memory/1844-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1844	0aa37ab18bc6dcfb45b32b7047097884.exe

Executes dropped EXE 1 IoCs

pid	Process
1844	0aa37ab18bc6dcfb45b32b7047097884.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3688-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0009000000023221-11.dat	upx
behavioral2/memory/1844-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3688	0aa37ab18bc6dcfb45b32b7047097884.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3688	0aa37ab18bc6dcfb45b32b7047097884.exe
1844	0aa37ab18bc6dcfb45b32b7047097884.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 1844	3688	0aa37ab18bc6dcfb45b32b7047097884.exe	93
PID 3688 wrote to memory of 1844	3688	0aa37ab18bc6dcfb45b32b7047097884.exe	93
PID 3688 wrote to memory of 1844	3688	0aa37ab18bc6dcfb45b32b7047097884.exe	93

C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe
"C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe
  C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0aa37ab18bc6dcfb45b32b7047097884.exe

Filesize
784KB

MD5
20879acf2e3658cfba1874f88efaafb3

SHA1
d8dc39decbf95d02796bf55eb1f5802d31427938

SHA256
78bf761629835c160a81e95b9fd7ee641aebe236e7f16deb2a628155dba8a99c

SHA512
bff7aee9a981c885d3fe84e7b3db37888db8e69fbf0a15cb1cf06ef81bf1030eac84f1aa6c9a6682d5d01913c6534d95dbd2a3bd314454778041b85739891755

Download Submit
memory/1844-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1844-15-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/1844-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1844-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1844-20-0x0000000005580000-0x0000000005713000-memory.dmp

Filesize
1.6MB

Download
memory/1844-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3688-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3688-1-0x00000000017F0000-0x00000000018B4000-memory.dmp

Filesize
784KB

Download
memory/3688-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3688-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download