xmrig | 3c1657296dbc0b00d33f5670e7bbb2cb924dba9dc57432b924ea29fa811b36f1

Analysis

max time kernel
170s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a21009e2ec33a21b342e44263a267a2.exe
Size

784KB
MD5

2a21009e2ec33a21b342e44263a267a2
SHA1

c0c325169e99a463dc31911a10019cb21fc730bd
SHA256

3c1657296dbc0b00d33f5670e7bbb2cb924dba9dc57432b924ea29fa811b36f1
SHA512

bdec5401b4e56f9c3e8736a8415258e6e549b2e47c46a93f8285870df89e41bfc293f8b24db9381c72ed0f81dba70aee6ab8016358faa384c888960f925f2413
SSDEEP

12288:57Ldx/eQSkFEof+TfDfIBWR4M5F1z1qTHqTLncs7ZvzfNwWxFQT2bhTbSQDLvFl7:5bp+Tf8G4UF918HqTzcs7Zpvnrnn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/1436-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1436-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1760-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1760-20-0x00000000053B0000-0x0000000005543000-memory.dmp	xmrig
behavioral2/memory/1760-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1760-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1760	2a21009e2ec33a21b342e44263a267a2.exe

Executes dropped EXE 1 IoCs

pid	Process
1760	2a21009e2ec33a21b342e44263a267a2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1436-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000500000001e715-11.dat	upx
behavioral2/memory/1760-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1436	2a21009e2ec33a21b342e44263a267a2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1436	2a21009e2ec33a21b342e44263a267a2.exe
1760	2a21009e2ec33a21b342e44263a267a2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1760	1436	2a21009e2ec33a21b342e44263a267a2.exe	92
PID 1436 wrote to memory of 1760	1436	2a21009e2ec33a21b342e44263a267a2.exe	92
PID 1436 wrote to memory of 1760	1436	2a21009e2ec33a21b342e44263a267a2.exe	92

C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe
"C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe
  C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe

Filesize
784KB

MD5
ac6b9325b921bf8f856a592b628c5640

SHA1
d1e0838ee71456dc344279e1279ed0bd31b4f293

SHA256
a51fdebe6ab52b8e911c9271f71de929b473aeeb270eb62168bb6ce4b7af1793

SHA512
bafe29e3f37ea41a3d94cc8041e9d5532df5cf765ebce43e5899a83c7e3b6e018edab6e832be0d39e6c2e18059365e01433cd3661d04bba036eaa116f3ab859a

Download Submit
memory/1436-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1436-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/1436-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1436-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1760-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1760-14-0x00000000019C0000-0x0000000001A84000-memory.dmp

Filesize
784KB

Download
memory/1760-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1760-20-0x00000000053B0000-0x0000000005543000-memory.dmp

Filesize
1.6MB

Download
memory/1760-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1760-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download