xmrig | 5bd8ece22b31703df1228fd0540f485cfa9ce782ca0c32bc948adaeb7d3a29c4

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b588725a866b648e6f7f3ef366ed8d7a.exe
Size

784KB
MD5

b588725a866b648e6f7f3ef366ed8d7a
SHA1

7b1b5dc243acc73ac26f68fa7ca1a07e2b2923ef
SHA256

5bd8ece22b31703df1228fd0540f485cfa9ce782ca0c32bc948adaeb7d3a29c4
SHA512

b5c99ee26a08782d6bc47de986f79460172f67603cea9728eeaec62b5c8b1c6f5f9940ae196997a175206defcae12d072da6cf627ed864a0ce732afc4f26ba03
SSDEEP

24576:Qm96fcoc+EY1KDlAoYivbaKKG1N2qhWS7yQK/BU:L96koTEY1Ka4vrjLWzQKZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2708-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2708-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4068-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4068-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4068-22-0x0000000005490000-0x0000000005623000-memory.dmp	xmrig
behavioral2/memory/4068-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4068	b588725a866b648e6f7f3ef366ed8d7a.exe

Executes dropped EXE 1 IoCs

pid	Process
4068	b588725a866b648e6f7f3ef366ed8d7a.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2708-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000d00000002315a-11.dat	upx
behavioral2/memory/4068-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2708	b588725a866b648e6f7f3ef366ed8d7a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2708	b588725a866b648e6f7f3ef366ed8d7a.exe
4068	b588725a866b648e6f7f3ef366ed8d7a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4068	2708	b588725a866b648e6f7f3ef366ed8d7a.exe	88
PID 2708 wrote to memory of 4068	2708	b588725a866b648e6f7f3ef366ed8d7a.exe	88
PID 2708 wrote to memory of 4068	2708	b588725a866b648e6f7f3ef366ed8d7a.exe	88

C:\Users\Admin\AppData\Local\Temp\b588725a866b648e6f7f3ef366ed8d7a.exe
"C:\Users\Admin\AppData\Local\Temp\b588725a866b648e6f7f3ef366ed8d7a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\b588725a866b648e6f7f3ef366ed8d7a.exe
  C:\Users\Admin\AppData\Local\Temp\b588725a866b648e6f7f3ef366ed8d7a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b588725a866b648e6f7f3ef366ed8d7a.exe

Filesize
784KB

MD5
f7766de7cd8bfa55bd2e12cdbc655ac2

SHA1
acfb55397aa20cc86996a8fe0a444e7372c741dc

SHA256
f109f368d68a1c3cd2ffe9e6199cf4618d0bbc89091610d36b9f70b0cb717232

SHA512
8fcfe57c4bd4458bbb2c526ce6bafbc380b1cff46d297365598ab31c19b371137258f4f3b1aed892e8c374ee8fc74b5c3557919d8752e60ca4a3028f45587e1d

Download Submit
memory/2708-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2708-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2708-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2708-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4068-15-0x0000000001AA0000-0x0000000001B64000-memory.dmp

Filesize
784KB

Download
memory/4068-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4068-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4068-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4068-22-0x0000000005490000-0x0000000005623000-memory.dmp

Filesize
1.6MB

Download
memory/4068-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download