xmrig | dfb17e1b4af169805e740da57b51d88ef91df874f2a0f000127df2cad6e59b6e

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bed2e19c34c45d5ea150ac6d2ace4530.exe
Size

784KB
MD5

bed2e19c34c45d5ea150ac6d2ace4530
SHA1

2fc0d668711fc23406df96c4ab22d8b5e52d9425
SHA256

dfb17e1b4af169805e740da57b51d88ef91df874f2a0f000127df2cad6e59b6e
SHA512

efc0ba1ab044392adf8acc2250bb1b7e91839852f9800979474131b5d48ff062fc2eb4e893d9528f20c06f668d722e39392494dc35a9c721e5a14d2acca1fe97
SSDEEP

12288:ZDxyv61l2i1ZCkjScGjWpt8Bojzt9H0bNZbr0jjzJimbEOHucNYC9uaZB:fymZmW39bksjjgMHucNYC9u8B

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2436-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2436-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/5116-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/5116-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/5116-21-0x0000000005480000-0x0000000005613000-memory.dmp	xmrig
behavioral2/memory/5116-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
5116	bed2e19c34c45d5ea150ac6d2ace4530.exe

Executes dropped EXE 1 IoCs

pid	Process
5116	bed2e19c34c45d5ea150ac6d2ace4530.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2436-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000c000000023156-11.dat	upx
behavioral2/memory/5116-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2436	bed2e19c34c45d5ea150ac6d2ace4530.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2436	bed2e19c34c45d5ea150ac6d2ace4530.exe
5116	bed2e19c34c45d5ea150ac6d2ace4530.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 5116	2436	bed2e19c34c45d5ea150ac6d2ace4530.exe	90
PID 2436 wrote to memory of 5116	2436	bed2e19c34c45d5ea150ac6d2ace4530.exe	90
PID 2436 wrote to memory of 5116	2436	bed2e19c34c45d5ea150ac6d2ace4530.exe	90

C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe
"C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe
  C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bed2e19c34c45d5ea150ac6d2ace4530.exe

Filesize
319KB

MD5
9beb1b516609c5a2ff47c77c829fc3a2

SHA1
6178083b7942722f5d24ccf5db3e92d1c10676ea

SHA256
376e0e391d41ab75d91a2e3f64c9689db6d72bde4ef475c00cef263950c93ab2

SHA512
d3fa49fcb82eaf5bde1a0b4f2beade095719b4def774594255ba279a27270efa6bed213c1ce41304530de9172d5429012d369c7f5d37d1a9402b4a809905367c

Download Submit
memory/2436-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2436-1-0x00000000017F0000-0x00000000018B4000-memory.dmp

Filesize
784KB

Download
memory/2436-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2436-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5116-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/5116-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5116-14-0x0000000001A90000-0x0000000001B54000-memory.dmp

Filesize
784KB

Download
memory/5116-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/5116-21-0x0000000005480000-0x0000000005613000-memory.dmp

Filesize
1.6MB

Download
memory/5116-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download