xmrig | fd0d6e34fab3121d5cedb02efa25a7fa2ffeab063d7cbdf749e22b1d59834692

Analysis

max time kernel
117s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e9d09321ced5043eb740f4206716b56.exe
Size

784KB
MD5

6e9d09321ced5043eb740f4206716b56
SHA1

7b3039542073be9618c66a20f736054d148dad2c
SHA256

fd0d6e34fab3121d5cedb02efa25a7fa2ffeab063d7cbdf749e22b1d59834692
SHA512

9dcf03adbe454601d9dd0b1d47153980c59c21950c19c0d8463b8716824993d0d5eadf24e639e59669f248cf2c9a0afeea07126a40bb9bc576c3dbe72040b1bc
SSDEEP

24576:cnoVTSAacAgb2m3M5vAlZS7g5DxISX88:dQ1Hex3IAy7g5DxIAP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4652-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4652-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4868-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4868-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4868-20-0x00000000054C0000-0x0000000005653000-memory.dmp	xmrig
behavioral2/memory/4868-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4868	6e9d09321ced5043eb740f4206716b56.exe

Executes dropped EXE 1 IoCs

pid	Process
4868	6e9d09321ced5043eb740f4206716b56.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4652-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/memory/4868-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000a0000000231e9-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4652	6e9d09321ced5043eb740f4206716b56.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4652	6e9d09321ced5043eb740f4206716b56.exe
4868	6e9d09321ced5043eb740f4206716b56.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4868	4652	6e9d09321ced5043eb740f4206716b56.exe	19
PID 4652 wrote to memory of 4868	4652	6e9d09321ced5043eb740f4206716b56.exe	19
PID 4652 wrote to memory of 4868	4652	6e9d09321ced5043eb740f4206716b56.exe	19

C:\Users\Admin\AppData\Local\Temp\6e9d09321ced5043eb740f4206716b56.exe
"C:\Users\Admin\AppData\Local\Temp\6e9d09321ced5043eb740f4206716b56.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\6e9d09321ced5043eb740f4206716b56.exe
  C:\Users\Admin\AppData\Local\Temp\6e9d09321ced5043eb740f4206716b56.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6e9d09321ced5043eb740f4206716b56.exe

Filesize
5KB

MD5
e15351a895b788a9ba490ccd518e847d

SHA1
be47dd20d28983e9651c40f8d9624c4ecef90548

SHA256
ff278c3bb5f13a562ca85978ec264cf742bf2532da0461ac197005149a77ddba

SHA512
b8812452b11b44228af1bc568560fb90cff024eedce456f4e58e69e17c7152ea82b98c846b6114047cae2be3a4cec6fada6c32d450b15a6e2a39ab2025860c54

Download Submit
memory/4652-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4652-1-0x0000000001A60000-0x0000000001B24000-memory.dmp

Filesize
784KB

Download
memory/4652-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4652-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4868-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4868-16-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4868-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4868-20-0x00000000054C0000-0x0000000005653000-memory.dmp

Filesize
1.6MB

Download
memory/4868-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4868-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download