xmrig | b74750109cd5995f85aafcf03a9beff5ec3fcf9003ba18724808ddef18981c80

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014fc7ab3c40ff0022297260970db243.exe
Size

1.5MB
MD5

014fc7ab3c40ff0022297260970db243
SHA1

bc1e92e503e6ae388cd48b4bb37c8034728b4363
SHA256

b74750109cd5995f85aafcf03a9beff5ec3fcf9003ba18724808ddef18981c80
SHA512

02f1a7356fe28bdcde7f690df0b13e9a3203f7ec0c0fc6efc8f9fe7baf07cb45d365fad4f78feefd840ead7c2afa2efc7dd342230c37da2c0a7cd94ac80f5ee0
SSDEEP

49152:MuZzsdYY5axZ4q7woGv2YDNQHVx85311CZYwSc:MuZzrkeGv2YDN+P85311CZhSc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2584-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2584-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2240-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2240-21-0x00000000053C0000-0x0000000005553000-memory.dmp	xmrig
behavioral2/memory/2240-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2240-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2240	014fc7ab3c40ff0022297260970db243.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	014fc7ab3c40ff0022297260970db243.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2584-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00070000000231f3-11.dat	upx
behavioral2/memory/2240-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2584	014fc7ab3c40ff0022297260970db243.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2584	014fc7ab3c40ff0022297260970db243.exe
2240	014fc7ab3c40ff0022297260970db243.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2240	2584	014fc7ab3c40ff0022297260970db243.exe	90
PID 2584 wrote to memory of 2240	2584	014fc7ab3c40ff0022297260970db243.exe	90
PID 2584 wrote to memory of 2240	2584	014fc7ab3c40ff0022297260970db243.exe	90

C:\Users\Admin\AppData\Local\Temp\014fc7ab3c40ff0022297260970db243.exe
"C:\Users\Admin\AppData\Local\Temp\014fc7ab3c40ff0022297260970db243.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\014fc7ab3c40ff0022297260970db243.exe
  C:\Users\Admin\AppData\Local\Temp\014fc7ab3c40ff0022297260970db243.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\014fc7ab3c40ff0022297260970db243.exe

Filesize
279KB

MD5
68f2bc49adc5b48589f50a69f728da3e

SHA1
e25eeeabf1c2a8b6cf72dc61a4a77cc37d10cbf6

SHA256
93abd250ae940785e209a933c77ba248ff6facf6d06b39233ff4d779fa479d3e

SHA512
28de091ca57e4d49913f4c18c73d988dddcccaeca56db6fed62b7048fb203fbedbb8c1e5e45656b4b6dfec14dbb62817a31c8582e28b0a6f2ce74a7bde877524

Download Submit
memory/2240-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2240-14-0x00000000019D0000-0x0000000001A94000-memory.dmp

Filesize
784KB

Download
memory/2240-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2240-21-0x00000000053C0000-0x0000000005553000-memory.dmp

Filesize
1.6MB

Download
memory/2240-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2240-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2584-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2584-1-0x0000000001A40000-0x0000000001B04000-memory.dmp

Filesize
784KB

Download
memory/2584-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2584-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download