xmrig | 32095a992ccf2b02a33b5b5cac4589943de557d03247a1a4c7aca229230b74a5

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

683b060d3b37ce95a44f30e75a6093fe.exe
Size

784KB
MD5

683b060d3b37ce95a44f30e75a6093fe
SHA1

d47fd9793e439f3a0e5588c9aa7f73d85837de4d
SHA256

32095a992ccf2b02a33b5b5cac4589943de557d03247a1a4c7aca229230b74a5
SHA512

8e015290282aeacaef7ab193e4a4afd5c0c76b72e094a35f491b382c6b5506aaf3469354de0d9434cbdc09872a99bfde743bc827d27e82dcdf2bb6caeb6bbba3
SSDEEP

24576:4MgEV+siUKfwpTCHOC+uy2k49Z9YDUF+J:4XEIJMTax+ukUZeDw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4136-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4136-13-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4560-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4560-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4560-21-0x0000000005480000-0x0000000005613000-memory.dmp	xmrig
behavioral2/memory/4560-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4560	683b060d3b37ce95a44f30e75a6093fe.exe

Executes dropped EXE 1 IoCs

pid	Process
4560	683b060d3b37ce95a44f30e75a6093fe.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4136-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0006000000023227-11.dat	upx
behavioral2/memory/4560-12-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4136	683b060d3b37ce95a44f30e75a6093fe.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4136	683b060d3b37ce95a44f30e75a6093fe.exe
4560	683b060d3b37ce95a44f30e75a6093fe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4560	4136	683b060d3b37ce95a44f30e75a6093fe.exe	91
PID 4136 wrote to memory of 4560	4136	683b060d3b37ce95a44f30e75a6093fe.exe	91
PID 4136 wrote to memory of 4560	4136	683b060d3b37ce95a44f30e75a6093fe.exe	91

C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe
"C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe
  C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\683b060d3b37ce95a44f30e75a6093fe.exe

Filesize
784KB

MD5
a08c4f9f7e8aed67250515a987644b07

SHA1
ce6791dae285a4f1b44a0710e8418cbadb246e54

SHA256
e1e878e2652e98b83800b72a485a8ec01e1bc09e93be6bdf37ba1fe4f4d982a2

SHA512
21468b1420a568578267a0cffcda263c63d317dea68b4c88596bc67ea2fdc7df457f2b61a586edf642ac5c3056aeb73d8bd0a018f6fbf3f48cca0796ad8be92b

Download Submit
memory/4136-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4136-1-0x0000000001910000-0x00000000019D4000-memory.dmp

Filesize
784KB

Download
memory/4136-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4136-13-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4560-12-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4560-15-0x0000000001910000-0x00000000019D4000-memory.dmp

Filesize
784KB

Download
memory/4560-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4560-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4560-21-0x0000000005480000-0x0000000005613000-memory.dmp

Filesize
1.6MB

Download
memory/4560-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download