xmrig | dfb17e1b4af169805e740da57b51d88ef91df874f2a0f000127df2cad6e59b6e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bed2e19c34c45d5ea150ac6d2ace4530.exe
Size

784KB
MD5

bed2e19c34c45d5ea150ac6d2ace4530
SHA1

2fc0d668711fc23406df96c4ab22d8b5e52d9425
SHA256

dfb17e1b4af169805e740da57b51d88ef91df874f2a0f000127df2cad6e59b6e
SHA512

efc0ba1ab044392adf8acc2250bb1b7e91839852f9800979474131b5d48ff062fc2eb4e893d9528f20c06f668d722e39392494dc35a9c721e5a14d2acca1fe97
SSDEEP

12288:ZDxyv61l2i1ZCkjScGjWpt8Bojzt9H0bNZbr0jjzJimbEOHucNYC9uaZB:fymZmW39bksjjgMHucNYC9u8B

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2276-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2276-15-0x00000000030E0000-0x00000000033F2000-memory.dmp	xmrig
behavioral1/memory/2276-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2648-25-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2648-24-0x0000000003220000-0x00000000033B3000-memory.dmp	xmrig
behavioral1/memory/2648-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2648-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2648	bed2e19c34c45d5ea150ac6d2ace4530.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	bed2e19c34c45d5ea150ac6d2ace4530.exe

Loads dropped DLL 1 IoCs

pid	Process
2276	bed2e19c34c45d5ea150ac6d2ace4530.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/memory/2276-15-0x00000000030E0000-0x00000000033F2000-memory.dmp	upx
behavioral1/memory/2648-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000800000001223f-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2276	bed2e19c34c45d5ea150ac6d2ace4530.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2276	bed2e19c34c45d5ea150ac6d2ace4530.exe
2648	bed2e19c34c45d5ea150ac6d2ace4530.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2648	2276	bed2e19c34c45d5ea150ac6d2ace4530.exe	29
PID 2276 wrote to memory of 2648	2276	bed2e19c34c45d5ea150ac6d2ace4530.exe	29
PID 2276 wrote to memory of 2648	2276	bed2e19c34c45d5ea150ac6d2ace4530.exe	29
PID 2276 wrote to memory of 2648	2276	bed2e19c34c45d5ea150ac6d2ace4530.exe	29

C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe
"C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe
  C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe

Filesize
605KB

MD5
2e1f8d58973998e15456a7e67e710e1d

SHA1
3d017e86695bb7e7e4028131025d1366356c4c4a

SHA256
8d72b273ae5f38e806779165c597cdcbace3e6e9613756e555becc189fa7cdcd

SHA512
429631878cb61fca09e2d5c4c4e757a8d8914a024545e260dd716b21aa99f45d66168454a7156fefae4bd408816cada2e509532a8e5de642b16eb7d0dddadcc7

Download Submit
memory/2276-2-0x0000000000300000-0x00000000003C4000-memory.dmp

Filesize
784KB

Download
memory/2276-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2276-15-0x00000000030E0000-0x00000000033F2000-memory.dmp

Filesize
3.1MB

Download
memory/2276-35-0x00000000030E0000-0x00000000033F2000-memory.dmp

Filesize
3.1MB

Download
memory/2276-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2276-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2648-19-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2648-24-0x0000000003220000-0x00000000033B3000-memory.dmp

Filesize
1.6MB

Download
memory/2648-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2648-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2648-25-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2648-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download