xmrig | 749524122994231f1b6404cce7e7b19d96d16977f461df3ad14dc4cce121d42f

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cfc11b577cb8b6fceb1219b2cabb8a2.exe
Size

784KB
MD5

1cfc11b577cb8b6fceb1219b2cabb8a2
SHA1

45ac93a99558a05df36acc4d163514ce0df7d411
SHA256

749524122994231f1b6404cce7e7b19d96d16977f461df3ad14dc4cce121d42f
SHA512

9f4718d45ed33d102842e9ee922da32a7c6e70d8f4bd34000dbde1acca3820eb50138edb57f6c87b5b1881ee0a798b0dc6ff19272e6c0660cb25a637b01f858e
SSDEEP

12288:f3f2t2w8zsKuGLvNi2AlzfxzllnG0EM3wRXtAm+ryeIB46Ti8NECRmqdwK:fPpwoQlbxbnEowWrR6ld

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2524-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2320-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2320-26-0x0000000003240000-0x00000000033D3000-memory.dmp	xmrig
behavioral1/memory/2320-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2524-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2320-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2320-34-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2524-36-0x0000000003240000-0x0000000003552000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2320	1cfc11b577cb8b6fceb1219b2cabb8a2.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	1cfc11b577cb8b6fceb1219b2cabb8a2.exe

Loads dropped DLL 1 IoCs

pid	Process
2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000a000000012243-10.dat	upx
behavioral1/files/0x000a000000012243-16.dat	upx
behavioral1/memory/2524-15-0x0000000003240000-0x0000000003552000-memory.dmp	upx
behavioral1/memory/2320-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe
2320	1cfc11b577cb8b6fceb1219b2cabb8a2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2320	2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe	29
PID 2524 wrote to memory of 2320	2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe	29
PID 2524 wrote to memory of 2320	2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe	29
PID 2524 wrote to memory of 2320	2524	1cfc11b577cb8b6fceb1219b2cabb8a2.exe	29

C:\Users\Admin\AppData\Local\Temp\1cfc11b577cb8b6fceb1219b2cabb8a2.exe
"C:\Users\Admin\AppData\Local\Temp\1cfc11b577cb8b6fceb1219b2cabb8a2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\1cfc11b577cb8b6fceb1219b2cabb8a2.exe
  C:\Users\Admin\AppData\Local\Temp\1cfc11b577cb8b6fceb1219b2cabb8a2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1cfc11b577cb8b6fceb1219b2cabb8a2.exe

Filesize
381KB

MD5
decbb05a7503c57a92323af0bb2181d4

SHA1
d523a333c677d8223e0a8c6378bf15cf5807a60a

SHA256
d8de0566c224214e0ac4614cad8bbef3882d3658556591555473d1007ecd61a6

SHA512
2f6e1e1eaafc79a715857ec7bd06b508fd332bcbc9c7f14d2cd29a2480a36e0de57433af1ed49b3135f25e4aac2a72b10293cedb9de0b8710a8584f014564297

Download Submit
memory/2320-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2320-19-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2320-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2320-26-0x0000000003240000-0x00000000033D3000-memory.dmp

Filesize
1.6MB

Download
memory/2320-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2320-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2320-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2524-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2524-2-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2524-15-0x0000000003240000-0x0000000003552000-memory.dmp

Filesize
3.1MB

Download
memory/2524-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2524-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2524-36-0x0000000003240000-0x0000000003552000-memory.dmp

Filesize
3.1MB

Download