xmrig | 091302a18e1bf85de2cdede03e15bb0c8f8ea01568a72745df2e0fabc5b74efd

Analysis

max time kernel
148s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67b29069068075b7818ec84bf5382e9f.exe
Size

1.5MB
MD5

67b29069068075b7818ec84bf5382e9f
SHA1

c169882de30bc7e31a6b8c0454aa19eaa46ecf62
SHA256

091302a18e1bf85de2cdede03e15bb0c8f8ea01568a72745df2e0fabc5b74efd
SHA512

bad15bfef43137c2054c3407a488db890648e42406f70b28eb06886fcf62bc4e6e49270f86bfd893a18c899560663c04ec7a4861cc913d76cc1e655dd9505916
SSDEEP

24576:puoKwKdYObCAqkBktLtNsaFujWi+0YlfMg3xvWRUMn0Vj75CFtBrpBkS05i7XxVW:pujdYhmuWsHiHgdEKHMtrfd0k7XbWFt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3964-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3964-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4420-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4420-21-0x00000000055A0000-0x0000000005733000-memory.dmp	xmrig
behavioral2/memory/4420-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4420-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4420	67b29069068075b7818ec84bf5382e9f.exe

Executes dropped EXE 1 IoCs

pid	Process
4420	67b29069068075b7818ec84bf5382e9f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3964-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/memory/4420-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000700000002321b-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3964	67b29069068075b7818ec84bf5382e9f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3964	67b29069068075b7818ec84bf5382e9f.exe
4420	67b29069068075b7818ec84bf5382e9f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4420	3964	67b29069068075b7818ec84bf5382e9f.exe	18
PID 3964 wrote to memory of 4420	3964	67b29069068075b7818ec84bf5382e9f.exe	18
PID 3964 wrote to memory of 4420	3964	67b29069068075b7818ec84bf5382e9f.exe	18

C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe
"C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe
  C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67b29069068075b7818ec84bf5382e9f.exe

Filesize
64KB

MD5
f7ab5ae84e9c5aab991987218ad48149

SHA1
da958c310d01f5e6619aba04e314236cafcf692a

SHA256
ff84f702b23be7cc0be97eb26147de5d95d6fd12ccba330b780d962fc82c8d43

SHA512
1f551ecd4c5c1e9e7fb225f65917d8dad11c915c8830161bddd6f732ad85088aba1be3d5f199363dabc6247a186783c341fd04ff3f2e1b8e076697f0f832f207

Download Submit
memory/3964-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3964-1-0x0000000001980000-0x0000000001A44000-memory.dmp

Filesize
784KB

Download
memory/3964-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3964-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4420-16-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4420-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4420-21-0x00000000055A0000-0x0000000005733000-memory.dmp

Filesize
1.6MB

Download
memory/4420-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4420-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4420-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download