xmrig | 0bb0242b16e0a664844b63c464a335e76e5348c85ac0182cd1899da41ac8a5bb

Analysis

max time kernel
118s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8d0f6647913538df2bf39a24740065f.exe
Size

784KB
MD5

f8d0f6647913538df2bf39a24740065f
SHA1

144b292a2045828b5eddc94b16b48b41b92bcb65
SHA256

0bb0242b16e0a664844b63c464a335e76e5348c85ac0182cd1899da41ac8a5bb
SHA512

c5fd231120088c4842994ccc293210759fb86f0845e21f67ffc19e33eaba33c7ac8c5f1bee154510a5ca15d524c240577c4322599a640377c39f1de19939278f
SSDEEP

24576:QgXYSQ9OH1QjhPNBtRo1wwwsewPN74LS6R6Q:ZZWjtRZNc4L7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2608-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2608-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4644-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4644-20-0x0000000005560000-0x00000000056F3000-memory.dmp	xmrig
behavioral2/memory/4644-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4644-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4644	f8d0f6647913538df2bf39a24740065f.exe

Executes dropped EXE 1 IoCs

pid	Process
4644	f8d0f6647913538df2bf39a24740065f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2608-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00070000000231fc-11.dat	upx
behavioral2/memory/4644-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2608	f8d0f6647913538df2bf39a24740065f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2608	f8d0f6647913538df2bf39a24740065f.exe
4644	f8d0f6647913538df2bf39a24740065f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4644	2608	f8d0f6647913538df2bf39a24740065f.exe	90
PID 2608 wrote to memory of 4644	2608	f8d0f6647913538df2bf39a24740065f.exe	90
PID 2608 wrote to memory of 4644	2608	f8d0f6647913538df2bf39a24740065f.exe	90

C:\Users\Admin\AppData\Local\Temp\f8d0f6647913538df2bf39a24740065f.exe
"C:\Users\Admin\AppData\Local\Temp\f8d0f6647913538df2bf39a24740065f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\f8d0f6647913538df2bf39a24740065f.exe
  C:\Users\Admin\AppData\Local\Temp\f8d0f6647913538df2bf39a24740065f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f8d0f6647913538df2bf39a24740065f.exe

Filesize
784KB

MD5
00316777b5a89ff55acb5d366937d3a3

SHA1
e3d4ee3183b14156d82cfc30aa10646a14454267

SHA256
4cfc37238d541677e232352189e3f7604cc241a204225dc80985bd5fbcfa5ed4

SHA512
9a942751963624dbe8d414759e9e1526e27f77a1c5285b2beb20cc3eddbbe23c9ebc00f293a2b5ba7550fb48c279a345001391322e1948e44ce01b6567227302

Download Submit
memory/2608-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2608-1-0x0000000001980000-0x0000000001A44000-memory.dmp

Filesize
784KB

Download
memory/2608-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2608-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4644-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4644-15-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4644-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4644-20-0x0000000005560000-0x00000000056F3000-memory.dmp

Filesize
1.6MB

Download
memory/4644-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4644-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download