xmrig | 694d63cef1e45208b5a1d4796f16cd56626d1aa28612d94dc33e026e6e6b6f54

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fcd5c9e663f12bfedeaf64b9d4de277.exe
Size

1.5MB
MD5

1fcd5c9e663f12bfedeaf64b9d4de277
SHA1

df42aa3b6c4e55c1dc8e0cb69dfbbb5c8233777f
SHA256

694d63cef1e45208b5a1d4796f16cd56626d1aa28612d94dc33e026e6e6b6f54
SHA512

3895a62cff7d60ada0e0bdfe3be22142e4092694bc383790088171e8e52c6fd98af134b74756f3ea3634cf4febd0ac3bc51c1cdcb82f1060918a5b668ee4d676
SSDEEP

49152:CjQTOM4vYDZmtdL4D3V/CJSjY/AEL2+aX:Ckt4wtmtdYFCJSjY/D5a

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2508-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/764-26-0x0000000003230000-0x00000000033C3000-memory.dmp	xmrig
behavioral1/memory/764-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/764-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/764-34-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/764-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2508-15-0x00000000034A0000-0x00000000037B2000-memory.dmp	xmrig
behavioral1/memory/2508-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
764	1fcd5c9e663f12bfedeaf64b9d4de277.exe

Executes dropped EXE 1 IoCs

pid	Process
764	1fcd5c9e663f12bfedeaf64b9d4de277.exe

Loads dropped DLL 1 IoCs

pid	Process
2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012251-10.dat	upx
behavioral1/memory/2508-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/memory/764-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/memory/2508-15-0x00000000034A0000-0x00000000037B2000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe
764	1fcd5c9e663f12bfedeaf64b9d4de277.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 764	2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe	17
PID 2508 wrote to memory of 764	2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe	17
PID 2508 wrote to memory of 764	2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe	17
PID 2508 wrote to memory of 764	2508	1fcd5c9e663f12bfedeaf64b9d4de277.exe	17

C:\Users\Admin\AppData\Local\Temp\1fcd5c9e663f12bfedeaf64b9d4de277.exe
C:\Users\Admin\AppData\Local\Temp\1fcd5c9e663f12bfedeaf64b9d4de277.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:764

C:\Users\Admin\AppData\Local\Temp\1fcd5c9e663f12bfedeaf64b9d4de277.exe
"C:\Users\Admin\AppData\Local\Temp\1fcd5c9e663f12bfedeaf64b9d4de277.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1fcd5c9e663f12bfedeaf64b9d4de277.exe

Filesize
92KB

MD5
c291add66857b864496053c4469bf0e9

SHA1
1f3557268df6cf9da67461e4e42458b2096a051e

SHA256
d8a9f503c18216b89b4b56ffe458495a7ca7a534d10f804d995a89ccf39a0e07

SHA512
611efa0e92048257fdb8ab7363de568b7dcc547b6d63ed9975f29e46d9866d60d2db50967b0e7a33ddef80b489e7979b3dfa9e8d13f3dafaa2d1979266525aca

Download Submit
memory/764-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/764-19-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/764-26-0x0000000003230000-0x00000000033C3000-memory.dmp

Filesize
1.6MB

Download
memory/764-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/764-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/764-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/764-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2508-3-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2508-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2508-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2508-15-0x00000000034A0000-0x00000000037B2000-memory.dmp

Filesize
3.1MB

Download
memory/2508-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download