xmrig | c8b2a95772513443b8190da58118e3fbfa5bb1de6fb61bfc9591e6ed005c72b6

General

Target

a04e6163df65a8e04e2b475d0cf15755.exe
Size

21.7MB
MD5

a04e6163df65a8e04e2b475d0cf15755
SHA1

3addae560d8d0d6c3f90231aeb5bba31f32f3ede
SHA256

c8b2a95772513443b8190da58118e3fbfa5bb1de6fb61bfc9591e6ed005c72b6
SHA512

0c63422273d46e6b4e255fcfd78362665b90e1bfa2d2a8b733f7c7c83f2a8050b6955b893522ecd2ee59e1f84b0a4546c05f5ca7bc333fd26d5e257cd7f48ce9
SSDEEP

393216:fgLhy8yLsNyFQJ+Fx8VWUt6XM9g0rTwygZHz1aMbeLn0/JJzyGsnbhsRfg:I1JCswFQJ+FGr6XM9g0g5z1aMaD0xJH2

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2772-11-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-13-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-15-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-17-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-19-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-23-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-25-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-34-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-31-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-29-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-21-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-35-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-38-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig
behavioral1/memory/2772-39-0x0000000140000000-0x0000000140705000-memory.dmp	xmrig

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	a04e6163df65a8e04e2b475d0cf15755.exe
Token: SeLockMemoryPrivilege	2772	explorer.exe
Token: SeLockMemoryPrivilege	2772	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29
PID 2440 wrote to memory of 2772	2440	a04e6163df65a8e04e2b475d0cf15755.exe	29

C:\Users\Admin\AppData\Local\Temp\a04e6163df65a8e04e2b475d0cf15755.exe
"C:\Users\Admin\AppData\Local\Temp\a04e6163df65a8e04e2b475d0cf15755.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe --cinit-find-x -B -a rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:3333 -u 44XUb34A5rdHk1oZSPfxneTeZWGasDV1aJKR1decyXbm1RLsM4Ti5URUVv2JaH7VXQTbWZFvsEDsaWRpFfxFXAYdPqGHrYZ -p --cpu-max-threads-hint=70
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-1-0x000000013FDE0000-0x0000000141392000-memory.dmp

Filesize
21.7MB

Download
memory/2440-0-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2440-2-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download
memory/2440-3-0x000000001C230000-0x000000001D7E0000-memory.dmp

Filesize
21.7MB

Download
memory/2440-32-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2772-5-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-33-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/2772-9-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-13-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-15-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-17-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-19-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-23-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-25-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-7-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-34-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-11-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-31-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-29-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-27-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Filesize
4KB

Download
memory/2772-21-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-35-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-36-0x0000000000150000-0x0000000000170000-memory.dmp

Filesize
128KB

Download
memory/2772-37-0x00000000003A0000-0x00000000003C0000-memory.dmp

Filesize
128KB

Download
memory/2772-38-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-39-0x0000000140000000-0x0000000140705000-memory.dmp

Filesize
7.0MB

Download
memory/2772-40-0x0000000000150000-0x0000000000170000-memory.dmp

Filesize
128KB

Download
memory/2772-41-0x00000000003A0000-0x00000000003C0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads