xmrig | 2ca43cb83ec4a5274a714cf09d996721bfcd99f21b05c0f91489d9ce45b06f73

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7fc879db96d29744df02ecb0218cb93e.exe
Size

784KB
MD5

7fc879db96d29744df02ecb0218cb93e
SHA1

8a1e72f23479ccf2269b6acd3e93a4089aff31ab
SHA256

2ca43cb83ec4a5274a714cf09d996721bfcd99f21b05c0f91489d9ce45b06f73
SHA512

eb3ec19c1b832c39e3136dded231b04970bac2d9d0436168edb096d5d43c5c05afa8856fa0ace8ac5838da72883b3cded0b75727fb2403de10aeb766ff540050
SSDEEP

12288:W/YqOe3EK8a8kxCeNEYZYPfC/flEL+s0TyuC4G84M87m3bxm6HoUbAT0HIX:AHOSwBkxCJK/NELf6t8oM61HC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2656-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2656-15-0x0000000003220000-0x0000000003532000-memory.dmp	xmrig
behavioral1/memory/2656-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2720-19-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2720-24-0x0000000003150000-0x00000000032E3000-memory.dmp	xmrig
behavioral1/memory/2720-25-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2720-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2720	7fc879db96d29744df02ecb0218cb93e.exe

Executes dropped EXE 1 IoCs

pid	Process
2720	7fc879db96d29744df02ecb0218cb93e.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	7fc879db96d29744df02ecb0218cb93e.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000e000000012232-10.dat	upx
behavioral1/memory/2720-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2656	7fc879db96d29744df02ecb0218cb93e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2656	7fc879db96d29744df02ecb0218cb93e.exe
2720	7fc879db96d29744df02ecb0218cb93e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2720	2656	7fc879db96d29744df02ecb0218cb93e.exe	29
PID 2656 wrote to memory of 2720	2656	7fc879db96d29744df02ecb0218cb93e.exe	29
PID 2656 wrote to memory of 2720	2656	7fc879db96d29744df02ecb0218cb93e.exe	29
PID 2656 wrote to memory of 2720	2656	7fc879db96d29744df02ecb0218cb93e.exe	29

C:\Users\Admin\AppData\Local\Temp\7fc879db96d29744df02ecb0218cb93e.exe
"C:\Users\Admin\AppData\Local\Temp\7fc879db96d29744df02ecb0218cb93e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\7fc879db96d29744df02ecb0218cb93e.exe
  C:\Users\Admin\AppData\Local\Temp\7fc879db96d29744df02ecb0218cb93e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\7fc879db96d29744df02ecb0218cb93e.exe

Filesize
784KB

MD5
8192ae99e6432b6ee145dca11284676a

SHA1
033a8bd10223dcbe78ac818d8102f025c7c1f163

SHA256
269be3ca4ef8be012f652d5de2c241358ec34a1f9d24fb9130aef4ae391f90fd

SHA512
bd3e85283022a9146185602bffadb2dbd77f44310a329b0cf62c2cb6c7fc58cde8806ffce6c7925e95cfcc9dace317d1ca46419d543acc7234c8ec26d542e07f

Download Submit
memory/2656-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2656-2-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2656-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2656-15-0x0000000003220000-0x0000000003532000-memory.dmp

Filesize
3.1MB

Download
memory/2656-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2720-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2720-18-0x00000000002C0000-0x0000000000384000-memory.dmp

Filesize
784KB

Download
memory/2720-19-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2720-24-0x0000000003150000-0x00000000032E3000-memory.dmp

Filesize
1.6MB

Download
memory/2720-25-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2720-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download