xmrig | 236efdff8783641d62f14e95a0704514a5e68c5dc8a1d2949193208d953299e6

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64676be1e84ce6fda28403022184377f.exe
Size

784KB
MD5

64676be1e84ce6fda28403022184377f
SHA1

d5138f887a75ac6e200e4d075740ea5040b1affc
SHA256

236efdff8783641d62f14e95a0704514a5e68c5dc8a1d2949193208d953299e6
SHA512

0d598d113017fa76f06f164c39b2ee5fa1ca24c8d43c3c9cc30958139972b542e5c4e7809ad0d4f1ff9f30e6563771b7dd4ec51e901423ba713d900b9012cc7a
SSDEEP

24576:FQH9a2sZctuuLXNZCCwvT44V1P/dQuJ6:FG02svYCxvUEPCu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3360-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3360-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3564-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3564-20-0x00000000053C0000-0x0000000005553000-memory.dmp	xmrig
behavioral2/memory/3564-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3564-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3564	64676be1e84ce6fda28403022184377f.exe

Executes dropped EXE 1 IoCs

pid	Process
3564	64676be1e84ce6fda28403022184377f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3360-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0006000000023200-11.dat	upx
behavioral2/memory/3564-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3360	64676be1e84ce6fda28403022184377f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3360	64676be1e84ce6fda28403022184377f.exe
3564	64676be1e84ce6fda28403022184377f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 3564	3360	64676be1e84ce6fda28403022184377f.exe	91
PID 3360 wrote to memory of 3564	3360	64676be1e84ce6fda28403022184377f.exe	91
PID 3360 wrote to memory of 3564	3360	64676be1e84ce6fda28403022184377f.exe	91

C:\Users\Admin\AppData\Local\Temp\64676be1e84ce6fda28403022184377f.exe
"C:\Users\Admin\AppData\Local\Temp\64676be1e84ce6fda28403022184377f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\64676be1e84ce6fda28403022184377f.exe
  C:\Users\Admin\AppData\Local\Temp\64676be1e84ce6fda28403022184377f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\64676be1e84ce6fda28403022184377f.exe

Filesize
784KB

MD5
21ab8bfc40ef94105ca5bbe02a278c77

SHA1
da177bf678dc2fe43f3542d8cc14d81a2208ce2c

SHA256
514a801b73554c10fa20c4b3ad9833c27eed25e82b950c95ab2897b9da912abf

SHA512
1e1ed966b86baceb97e7b246d0df72d13535c8368959353331f38ab76eb87fe6832eed23d4f1a384e83ed464ce4a4e0c4d79e8b8a977c75b37a0329ddf3b7fac

Download Submit
memory/3360-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3360-1-0x0000000001B40000-0x0000000001C04000-memory.dmp

Filesize
784KB

Download
memory/3360-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3360-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3564-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3564-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3564-14-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/3564-20-0x00000000053C0000-0x0000000005553000-memory.dmp

Filesize
1.6MB

Download
memory/3564-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3564-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download