xmrig | a66fd1f7ba6078fcfe672a744a7aeeb36d181a1ad6145073ff83c392a0c36839

Analysis

max time kernel
148s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f4abb6044bf4eb7c38777178c557de6.exe
Size

784KB
MD5

1f4abb6044bf4eb7c38777178c557de6
SHA1

24d1ddb07b17f660aa6b7a724f00c3b116316a3b
SHA256

a66fd1f7ba6078fcfe672a744a7aeeb36d181a1ad6145073ff83c392a0c36839
SHA512

2f3fa993d19d4d3c4d9a8410ffb08bb97e29d2cf34db19b88633313f6267a281ec2e6dfd61d228743f3c228cd1a25a7a006cdbdb1ad0895383726e71cb9fa546
SSDEEP

24576:7m1mhtSVcWb72Zj+eOt2rq6s+GtrT9tE9OoX:JUCs7GSeOtQtSrT9tE9N

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3164-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3164-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4560-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4560-21-0x0000000005460000-0x00000000055F3000-memory.dmp	xmrig
behavioral2/memory/4560-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4560-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4560	1f4abb6044bf4eb7c38777178c557de6.exe

Executes dropped EXE 1 IoCs

pid	Process
4560	1f4abb6044bf4eb7c38777178c557de6.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3164-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000200000001e7c9-11.dat	upx
behavioral2/memory/4560-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3164	1f4abb6044bf4eb7c38777178c557de6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3164	1f4abb6044bf4eb7c38777178c557de6.exe
4560	1f4abb6044bf4eb7c38777178c557de6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4560	3164	1f4abb6044bf4eb7c38777178c557de6.exe	93
PID 3164 wrote to memory of 4560	3164	1f4abb6044bf4eb7c38777178c557de6.exe	93
PID 3164 wrote to memory of 4560	3164	1f4abb6044bf4eb7c38777178c557de6.exe	93

C:\Users\Admin\AppData\Local\Temp\1f4abb6044bf4eb7c38777178c557de6.exe
"C:\Users\Admin\AppData\Local\Temp\1f4abb6044bf4eb7c38777178c557de6.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\1f4abb6044bf4eb7c38777178c557de6.exe
  C:\Users\Admin\AppData\Local\Temp\1f4abb6044bf4eb7c38777178c557de6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1f4abb6044bf4eb7c38777178c557de6.exe

Filesize
784KB

MD5
a249c9331390361bb37952512cf8d1b0

SHA1
8d7d14ea976cd8f9629e9752cebc11ac8e7bd282

SHA256
624cdd6f1529437ceb2765f52ee44a9b1ac213d6afd11bc1803ba79a8e915fd3

SHA512
b0bcb1b07c6a7fe4544f9cacfcbbe10ad1841236c9c5c91941623930b5b98f8a38d15b70c401350ebf8dd7fb3ffec1f4761cd729b44dae9fefd0efcc6f2cdd31

Download Submit
memory/3164-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3164-1-0x00000000018E0000-0x00000000019A4000-memory.dmp

Filesize
784KB

Download
memory/3164-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3164-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4560-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4560-14-0x0000000001A70000-0x0000000001B34000-memory.dmp

Filesize
784KB

Download
memory/4560-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4560-21-0x0000000005460000-0x00000000055F3000-memory.dmp

Filesize
1.6MB

Download
memory/4560-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4560-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download