xmrig | 1480048c08e8b883261acc4dfbe1928dd39cc9649d0e5170eac6a2f39060355d

General

Target

4450dc59512c910e7ce20b063d5acd0b.exe
Size

1.9MB
MD5

4450dc59512c910e7ce20b063d5acd0b
SHA1

6133d113c721a732db566cf69ec1525aa908b0e9
SHA256

1480048c08e8b883261acc4dfbe1928dd39cc9649d0e5170eac6a2f39060355d
SHA512

4a2d9d52ba8e31a73a394f98a03356aa978704e65e6e99a9c9a82ec6f7d4d917cc6b9f185ef04e4245612224392977a037974fc6b215f1542cc1d75cc974e2a7
SSDEEP

49152:4f0PSfuQ3kcK9Nx1z9AsG4yo+ViThP+/ysm2QcU8lAnp20:4tmQaD1DjTltm/4cU8lAs

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral2/memory/3080-6-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-8-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-10-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-12-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-13-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-14-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-15-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-16-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-17-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-19-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral2/memory/3080-20-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4484 set thread context of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3080	explorer.exe
Token: SeLockMemoryPrivilege	3080	explorer.exe
Token: SeIncBasePriorityPrivilege	3080	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90
PID 4484 wrote to memory of 3080	4484	4450dc59512c910e7ce20b063d5acd0b.exe	90

C:\Users\Admin\AppData\Local\Temp\4450dc59512c910e7ce20b063d5acd0b.exe
"C:\Users\Admin\AppData\Local\Temp\4450dc59512c910e7ce20b063d5acd0b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4484
- C:\WINDOWS\explorer.exe
  C:\WINDOWS\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --cpu-priority=5 --cpu-no-yield --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-west1.nanopool.org:14433 --user=449g4PYfaygbgzzWBnyL7BGy2FbDx7WB24HoVqFJkvjzQASg5eWMXLv4wrrZGCpLoehv6CX7UUDsJEMu2MwERwB44wHatQg.Rig1/Commander1942 --pass= --cpu-max-threads-hint=20 --donate-level=4 --tls
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3080-12-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-13-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-22-0x0000000001FD0000-0x0000000001FF0000-memory.dmp

Filesize
128KB

Download
memory/3080-21-0x0000000001FD0000-0x0000000001FF0000-memory.dmp

Filesize
128KB

Download
memory/3080-20-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-6-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-8-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-19-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-10-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-11-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/3080-18-0x0000000013E30000-0x0000000013E70000-memory.dmp

Filesize
256KB

Download
memory/3080-14-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-17-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-15-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/3080-16-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/4484-0-0x00000000007D0000-0x00000000009BE000-memory.dmp

Filesize
1.9MB

Download
memory/4484-1-0x0000000003330000-0x0000000003342000-memory.dmp

Filesize
72KB

Download
memory/4484-9-0x00007FFD4B1D0000-0x00007FFD4BC91000-memory.dmp

Filesize
10.8MB

Download
memory/4484-5-0x0000000003360000-0x0000000003368000-memory.dmp

Filesize
32KB

Download
memory/4484-4-0x000000001C5C0000-0x000000001C5D0000-memory.dmp

Filesize
64KB

Download
memory/4484-3-0x00007FFD4B1D0000-0x00007FFD4BC91000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing