xmrig | 32095a992ccf2b02a33b5b5cac4589943de557d03247a1a4c7aca229230b74a5

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

683b060d3b37ce95a44f30e75a6093fe.exe
Size

784KB
MD5

683b060d3b37ce95a44f30e75a6093fe
SHA1

d47fd9793e439f3a0e5588c9aa7f73d85837de4d
SHA256

32095a992ccf2b02a33b5b5cac4589943de557d03247a1a4c7aca229230b74a5
SHA512

8e015290282aeacaef7ab193e4a4afd5c0c76b72e094a35f491b382c6b5506aaf3469354de0d9434cbdc09872a99bfde743bc827d27e82dcdf2bb6caeb6bbba3
SSDEEP

24576:4MgEV+siUKfwpTCHOC+uy2k49Z9YDUF+J:4XEIJMTax+ukUZeDw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2216-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2216-16-0x0000000003230000-0x0000000003542000-memory.dmp	xmrig
behavioral1/memory/2828-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2828-18-0x0000000000400000-0x0000000000712000-memory.dmp	xmrig
behavioral1/memory/2216-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2828-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2828-27-0x0000000003220000-0x00000000033B3000-memory.dmp	xmrig
behavioral1/memory/2828-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2828	683b060d3b37ce95a44f30e75a6093fe.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	683b060d3b37ce95a44f30e75a6093fe.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	683b060d3b37ce95a44f30e75a6093fe.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000b000000015cfa-10.dat	upx
behavioral1/files/0x000b000000015cfa-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2216	683b060d3b37ce95a44f30e75a6093fe.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2216	683b060d3b37ce95a44f30e75a6093fe.exe
2828	683b060d3b37ce95a44f30e75a6093fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2828	2216	683b060d3b37ce95a44f30e75a6093fe.exe	29
PID 2216 wrote to memory of 2828	2216	683b060d3b37ce95a44f30e75a6093fe.exe	29
PID 2216 wrote to memory of 2828	2216	683b060d3b37ce95a44f30e75a6093fe.exe	29
PID 2216 wrote to memory of 2828	2216	683b060d3b37ce95a44f30e75a6093fe.exe	29

C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe
"C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe
  C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe

Filesize
273KB

MD5
c27fc48445aed6a2e1d71d7da44c1a5c

SHA1
8773d2d4e8cedf5267b0c35ad9307f6e228bfca2

SHA256
74d7c25a170e8e4b46bacccf5527c91e2c79d2df5a64b63b2b6cdf3480812921

SHA512
73b895f10ada7003ffbaada1f3e72cb9cc6544306526da09df91c865cd931f22579bd0aa5f76a0295ec2119fdfaf9f39d4a53f132d58b9763f92318195d8eaa7

Download Submit
\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe

Filesize
424KB

MD5
41a2d547c24116b726d4cdf98e0bacc2

SHA1
4f7b06f469b54dcb300464d767f25e0f7170b7dc

SHA256
2f48b03bf8624a83606c5e65f7dbb0cb6bfdf7c17662d0cdb4d1cfb682195c37

SHA512
5a82b323f7f4d2ba38394b977ac80e4f853a08acb2228dad9695e588653019430deb66f8484664b97d1c0d52d2463f40b75582a4100a6636410add30c9af4e3c

Download Submit
memory/2216-4-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2216-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2216-16-0x0000000003230000-0x0000000003542000-memory.dmp

Filesize
3.1MB

Download
memory/2216-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2216-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2828-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2828-18-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2828-20-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2828-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2828-27-0x0000000003220000-0x00000000033B3000-memory.dmp

Filesize
1.6MB

Download
memory/2828-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download