xmrig | 92973275d72ba0df71f520fa045546117b21db008754f76e1fb2da2e06e70a77

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9dd3c8efbe8aaf91cc6aedab6312a75.exe
Size

784KB
MD5

a9dd3c8efbe8aaf91cc6aedab6312a75
SHA1

45bff35683739538ce513ea7d912c23fc5fefe4a
SHA256

92973275d72ba0df71f520fa045546117b21db008754f76e1fb2da2e06e70a77
SHA512

c841c51fe6cd45eabb6418b61ad32fd6c8839521ed60dc394db629dcb896fabfe36d96c5a6b6947fe9687d3ae5fa525597ad87698ea49d196471a85d48d80e02
SSDEEP

24576:DsTtZkgKPJEyEnM9N6ekciVBmTw/4AbVxN:Ixm9aFM9NSc+k0/4Ap

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/880-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/224-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/224-22-0x00000000053C0000-0x0000000005553000-memory.dmp	xmrig
behavioral2/memory/224-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/224-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/880-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
224	a9dd3c8efbe8aaf91cc6aedab6312a75.exe

Executes dropped EXE 1 IoCs

pid	Process
224	a9dd3c8efbe8aaf91cc6aedab6312a75.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/880-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000c000000023151-11.dat	upx
behavioral2/memory/224-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
880	a9dd3c8efbe8aaf91cc6aedab6312a75.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
880	a9dd3c8efbe8aaf91cc6aedab6312a75.exe
224	a9dd3c8efbe8aaf91cc6aedab6312a75.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 224	880	a9dd3c8efbe8aaf91cc6aedab6312a75.exe	24
PID 880 wrote to memory of 224	880	a9dd3c8efbe8aaf91cc6aedab6312a75.exe	24
PID 880 wrote to memory of 224	880	a9dd3c8efbe8aaf91cc6aedab6312a75.exe	24

C:\Users\Admin\AppData\Local\Temp\a9dd3c8efbe8aaf91cc6aedab6312a75.exe
"C:\Users\Admin\AppData\Local\Temp\a9dd3c8efbe8aaf91cc6aedab6312a75.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\a9dd3c8efbe8aaf91cc6aedab6312a75.exe
  C:\Users\Admin\AppData\Local\Temp\a9dd3c8efbe8aaf91cc6aedab6312a75.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a9dd3c8efbe8aaf91cc6aedab6312a75.exe

Filesize
490KB

MD5
7f338679491cd2f45e2a60aabd1ac610

SHA1
511b7694e30b24198eda81f6b8e5a7017f36913d

SHA256
552dc395fa3c3456d3c5c82a0042d5049344fa33caf6b15b6ebf3e79f69d1e77

SHA512
377fc170a9b3219964552a9baebd4049af997071b2fa9c0a806564c16378211f97811cd144dd52a7da6b670e8ed8a2b7585973158ed83581996c7e52c0833f3f

Download Submit
memory/224-15-0x00000000019D0000-0x0000000001A94000-memory.dmp

Filesize
784KB

Download
memory/224-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/224-22-0x00000000053C0000-0x0000000005553000-memory.dmp

Filesize
1.6MB

Download
memory/224-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/224-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/224-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/880-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/880-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/880-1-0x0000000001AC0000-0x0000000001B84000-memory.dmp

Filesize
784KB

Download
memory/880-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download