xmrig | e9979481df346c2cdbe572c3a8c2a070f79ed0203d92478b29c97b4b66930e0c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06647f5bd3095a6fb53bd86b82d1da96.exe
Size

1.5MB
MD5

06647f5bd3095a6fb53bd86b82d1da96
SHA1

f495f0417466bf27895a761d11853f2f983ce002
SHA256

e9979481df346c2cdbe572c3a8c2a070f79ed0203d92478b29c97b4b66930e0c
SHA512

af7cc4ae0aef350df4f67c2669b6b6cba3c83f64426634bb70dd2e23a0024fc7cbeaa456841f846fbfcece069c56316b46032bfea34735be0072b963133343b0
SSDEEP

49152:aEgXa7vmHdnfQh9qVw1HenXeRVd8hURmrWcy:Cqz842JWd8hURcy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2012-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2732-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2732-18-0x0000000000400000-0x0000000000712000-memory.dmp	xmrig
behavioral1/memory/2732-27-0x0000000003100000-0x0000000003293000-memory.dmp	xmrig
behavioral1/memory/2732-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2732-34-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2732-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2012-16-0x0000000003310000-0x0000000003622000-memory.dmp	xmrig
behavioral1/memory/2012-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2732	06647f5bd3095a6fb53bd86b82d1da96.exe

Executes dropped EXE 1 IoCs

pid	Process
2732	06647f5bd3095a6fb53bd86b82d1da96.exe

Loads dropped DLL 1 IoCs

pid	Process
2012	06647f5bd3095a6fb53bd86b82d1da96.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2012	06647f5bd3095a6fb53bd86b82d1da96.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2012	06647f5bd3095a6fb53bd86b82d1da96.exe
2732	06647f5bd3095a6fb53bd86b82d1da96.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2732	2012	06647f5bd3095a6fb53bd86b82d1da96.exe	17
PID 2012 wrote to memory of 2732	2012	06647f5bd3095a6fb53bd86b82d1da96.exe	17
PID 2012 wrote to memory of 2732	2012	06647f5bd3095a6fb53bd86b82d1da96.exe	17
PID 2012 wrote to memory of 2732	2012	06647f5bd3095a6fb53bd86b82d1da96.exe	17

C:\Users\Admin\AppData\Local\Temp\06647f5bd3095a6fb53bd86b82d1da96.exe
C:\Users\Admin\AppData\Local\Temp\06647f5bd3095a6fb53bd86b82d1da96.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2732

C:\Users\Admin\AppData\Local\Temp\06647f5bd3095a6fb53bd86b82d1da96.exe
"C:\Users\Admin\AppData\Local\Temp\06647f5bd3095a6fb53bd86b82d1da96.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2012-2-0x0000000000330000-0x00000000003F4000-memory.dmp

Filesize
784KB

Download
memory/2012-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2012-16-0x0000000003310000-0x0000000003622000-memory.dmp

Filesize
3.1MB

Download
memory/2012-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2732-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2732-18-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2732-21-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2732-27-0x0000000003100000-0x0000000003293000-memory.dmp

Filesize
1.6MB

Download
memory/2732-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2732-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2732-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download