Overview

overview

10

Static

static

7

704809717c...f8.exe

windows7-x64

10

704809717c...f8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    704809717c645d73dbd00c474b8861f8.exe

  • Size

    784KB

  • MD5

    704809717c645d73dbd00c474b8861f8

  • SHA1

    3c7c353f74ef24aea8743371faa4f7585feb044d

  • SHA256

    d5b38b1395d38b71608d166a8784636a1ea2f071da71212db7bb465d318af4b6

  • SHA512

    eba575a0a68e5d47b3f88e9fe60c72062317156cb0d7bd9bd61c58b00905ffe28ae6cd4d45195bf6dafb7e9257d861e5b8b0bcaa6d81b1dd030ddbeade9bd71b

  • SSDEEP

    12288:BOKkgVQ08APQ8Tbq8HPvEj2DzAGvq5a7xXjiKiqTkKt501AqAmp8QbZht0L2R/R:aGFj7/PvEsxvq5a7xTiKiq4p1AgjB0

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 6 IoCs
    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\704809717c645d73dbd00c474b8861f8.exe
    "C:\Users\Admin\AppData\Local\Temp\704809717c645d73dbd00c474b8861f8.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Users\Admin\AppData\Local\Temp\704809717c645d73dbd00c474b8861f8.exe
      C:\Users\Admin\AppData\Local\Temp\704809717c645d73dbd00c474b8861f8.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:5088

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\704809717c645d73dbd00c474b8861f8.exe
          Filesize

          138KB

          MD5

          65a785accaa3cfa17d2e9aa6071efa5d

          SHA1

          8087c46467fb1a8194158b6b25b80d6f41f22281

          SHA256

          e1333c4cae225164bf2e5823417129deb170a6191ee006dd6d9e571563c86c89

          SHA512

          899bd425af5216e1d2e4f4faae80e081a2f269e9a3669287ec3aff9fbf81d58ce882ee6d1576bf72b56e230ade6c1ceae10bc02ffc598569b410d45d2bb3c270

          Download Submit

        • memory/2628-0-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2628-1-0x0000000001A10000-0x0000000001AD4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2628-2-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2628-12-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/5088-13-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/5088-15-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/5088-14-0x0000000001A00000-0x0000000001AC4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/5088-20-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/5088-21-0x00000000053F0000-0x0000000005583000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/5088-30-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download