xmrig | 879444af048c6c362369c8b6d3bca24aa78dcb628ad20414605e4d370358992e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c6212860a68410b131ac42c28eb023b.exe
Size

784KB
MD5

8c6212860a68410b131ac42c28eb023b
SHA1

5a6d612e38d45cd3c5fcce0e4f1df416bcb72867
SHA256

879444af048c6c362369c8b6d3bca24aa78dcb628ad20414605e4d370358992e
SHA512

2aa006f4d60496dcc4a5b839f04e16f58901dc8f618cccaa91a1aaab29d852b0516202e0b512b11bee6ebbf5d7d0a14b4b5be2d5343309d8d8c52a87540509c3
SSDEEP

24576:yVGIInGDfOx+bsc9tWrc7PW4XG4fe9tA:miGLO2jtWw7PW4XNW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3308-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3308-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1616-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1616-20-0x0000000005400000-0x0000000005593000-memory.dmp	xmrig
behavioral2/memory/1616-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1616-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1616	8c6212860a68410b131ac42c28eb023b.exe

Executes dropped EXE 1 IoCs

pid	Process
1616	8c6212860a68410b131ac42c28eb023b.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3308-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0007000000023210-11.dat	upx
behavioral2/memory/1616-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3308	8c6212860a68410b131ac42c28eb023b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3308	8c6212860a68410b131ac42c28eb023b.exe
1616	8c6212860a68410b131ac42c28eb023b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1616	3308	8c6212860a68410b131ac42c28eb023b.exe	51
PID 3308 wrote to memory of 1616	3308	8c6212860a68410b131ac42c28eb023b.exe	51
PID 3308 wrote to memory of 1616	3308	8c6212860a68410b131ac42c28eb023b.exe	51

C:\Users\Admin\AppData\Local\Temp\8c6212860a68410b131ac42c28eb023b.exe
"C:\Users\Admin\AppData\Local\Temp\8c6212860a68410b131ac42c28eb023b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\8c6212860a68410b131ac42c28eb023b.exe
  C:\Users\Admin\AppData\Local\Temp\8c6212860a68410b131ac42c28eb023b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8c6212860a68410b131ac42c28eb023b.exe

Filesize
273KB

MD5
bb7de1c9584e04eee8e50db57745b63a

SHA1
3b7ee4d77465e256a4da74fbc5fdbc52bda7870e

SHA256
56a9b45a5f3859a98d832e69ee357a469c5281bcbe06d135bfdbec9d797b38d4

SHA512
22eb415e12bbc031744f7094521fa4d3a5f2d7e5a1d72dd57c267acb00bcdbfc7895499b2f1369df593c0b11cd9f6981535d6773e9983b0eedf0ed6b1a9e126b

Download Submit
memory/1616-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1616-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1616-14-0x0000000001A10000-0x0000000001AD4000-memory.dmp

Filesize
784KB

Download
memory/1616-20-0x0000000005400000-0x0000000005593000-memory.dmp

Filesize
1.6MB

Download
memory/1616-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1616-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3308-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3308-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/3308-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3308-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download