xmrig | 27942005c57acec1d224a698bf9617b147ebd3d7c4d0bbabe0c492bc443b09cf

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80df06dff255c5ea40bf70ecc0a6abc8.exe
Size

784KB
MD5

80df06dff255c5ea40bf70ecc0a6abc8
SHA1

512d845c800d20dca1f3b80dafe368bcd2bd02d2
SHA256

27942005c57acec1d224a698bf9617b147ebd3d7c4d0bbabe0c492bc443b09cf
SHA512

8ab076e027908c232fff27a2b3d947b38249f841888ede1ad7c81a80802d64ed735056bcaa39d52830f9253b9eb8748eaa592a182cff69252b6fa95a18e8ab02
SSDEEP

24576:QrW+tnf7vfXW8mza33wdnE9rmFykf2HmYyYzFKUthCxYF:SRbX7mza33UWlVz57CSF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2756-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2756-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3936-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3936-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3936-20-0x00000000055A0000-0x0000000005733000-memory.dmp	xmrig
behavioral2/memory/3936-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3936	80df06dff255c5ea40bf70ecc0a6abc8.exe

Executes dropped EXE 1 IoCs

pid	Process
3936	80df06dff255c5ea40bf70ecc0a6abc8.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2756-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00070000000231f1-11.dat	upx
behavioral2/memory/3936-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2756	80df06dff255c5ea40bf70ecc0a6abc8.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2756	80df06dff255c5ea40bf70ecc0a6abc8.exe
3936	80df06dff255c5ea40bf70ecc0a6abc8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3936	2756	80df06dff255c5ea40bf70ecc0a6abc8.exe	93
PID 2756 wrote to memory of 3936	2756	80df06dff255c5ea40bf70ecc0a6abc8.exe	93
PID 2756 wrote to memory of 3936	2756	80df06dff255c5ea40bf70ecc0a6abc8.exe	93

C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe
"C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe
  C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80df06dff255c5ea40bf70ecc0a6abc8.exe

Filesize
439KB

MD5
6d6598530bf1db0299cec7e22df43669

SHA1
e4bb13898f440b021d1c56dcff70447b0d7a8865

SHA256
fa85ec5fa33b0ccea36607fb366e311c6578c6247f21f3028bd130146566ffb8

SHA512
fe476934d85f12e6763c658c0e0fe4f66d829596104e34fa423eb677208265536d5e27ba97d75bdcd150134d4a19ef932930cc4f7533cf92943add0cc676fd86

Download Submit
memory/2756-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2756-1-0x0000000001B10000-0x0000000001BD4000-memory.dmp

Filesize
784KB

Download
memory/2756-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2756-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3936-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3936-14-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/3936-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3936-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3936-20-0x00000000055A0000-0x0000000005733000-memory.dmp

Filesize
1.6MB

Download
memory/3936-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download