xmrig | 0e63be888098618dee0dde46c3605b6d980b3f79f9cfd88819bb80befe770104

Analysis

max time kernel
141s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aabdf8557cd7c9d074d1c3e49648b0f.exe
Size

784KB
MD5

7aabdf8557cd7c9d074d1c3e49648b0f
SHA1

540e7cde063f412abd52f6307dc38351aa67f8eb
SHA256

0e63be888098618dee0dde46c3605b6d980b3f79f9cfd88819bb80befe770104
SHA512

d7220a199165fda1836c932220c1b56573c5f81d70fdaeded85dacb2efab805d211da99bbc5c9123d5bbb0e4ad8f8b07fb33151665cba2da94a538f490736bd6
SSDEEP

12288:Wdy55mmJUkmR0YaucLVOEIpF10mWQwAMosWACcwhBLATU3TVR1P7v681Z/ZyibTq:755mmCh565OhpFaQWozPxAIx/uoXTq

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2552-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2552-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1940-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1940-20-0x00000000053C0000-0x0000000005553000-memory.dmp	xmrig
behavioral2/memory/1940-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1940-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1940	7aabdf8557cd7c9d074d1c3e49648b0f.exe

Executes dropped EXE 1 IoCs

pid	Process
1940	7aabdf8557cd7c9d074d1c3e49648b0f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2552-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0006000000023249-11.dat	upx
behavioral2/memory/1940-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2552	7aabdf8557cd7c9d074d1c3e49648b0f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2552	7aabdf8557cd7c9d074d1c3e49648b0f.exe
1940	7aabdf8557cd7c9d074d1c3e49648b0f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1940	2552	7aabdf8557cd7c9d074d1c3e49648b0f.exe	90
PID 2552 wrote to memory of 1940	2552	7aabdf8557cd7c9d074d1c3e49648b0f.exe	90
PID 2552 wrote to memory of 1940	2552	7aabdf8557cd7c9d074d1c3e49648b0f.exe	90

C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe
"C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe
  C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7aabdf8557cd7c9d074d1c3e49648b0f.exe

Filesize
784KB

MD5
e8a652025f8faea61aaa1a5f4eccc11f

SHA1
eb890c6ba31d3f90804cb6fd2ddb90c754c0b916

SHA256
3dc7e76f2ad8a271ebb2ccfcddf07f8f36ad515f426d44c03d1e849711a6c7ce

SHA512
c5a42ecd11306fdbc1b3d99895fd1ffe67177e21c4d9164cf39a34a66019571257d1c8dbf19da1e389c591dc25da50d5d2e9251699fe6d687b8f35a593a648a5

Download Submit
memory/1940-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1940-14-0x00000000019D0000-0x0000000001A94000-memory.dmp

Filesize
784KB

Download
memory/1940-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1940-20-0x00000000053C0000-0x0000000005553000-memory.dmp

Filesize
1.6MB

Download
memory/1940-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1940-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2552-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2552-1-0x00000000019C0000-0x0000000001A84000-memory.dmp

Filesize
784KB

Download
memory/2552-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2552-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download