xmrig | bbfcbc4b5f67dad03b34a7686f7a4c6bb4d4f93d330da57ff57c36e6f925f7bb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

290de93978d44a392a6f766b23cdf8cd.exe
Size

784KB
MD5

290de93978d44a392a6f766b23cdf8cd
SHA1

d9a612904a51b4c8fb4d7fc140147fd810fc2c05
SHA256

bbfcbc4b5f67dad03b34a7686f7a4c6bb4d4f93d330da57ff57c36e6f925f7bb
SHA512

24a5b6ffc8a1b7318b546e5fa130146ae6dbbac348887af08d19106b9d36e0fedce5c9d04d10f09fff3b381a8ef3b6eaf86283f8a8ed063c102455f41e17540b
SSDEEP

12288:735/JisEuyfixhypLtzKEY7EBmFls2RTaJN4gPFKM9TSf7HsS51gRTlTvW3MOS7C:7p/JivfmgNQd7E3iTu4G6DHnghJOMOS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2204-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2204-15-0x0000000003250000-0x0000000003562000-memory.dmp	xmrig
behavioral1/memory/2204-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2316-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2316-25-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2316-24-0x0000000003220000-0x00000000033B3000-memory.dmp	xmrig
behavioral1/memory/2316-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2316	290de93978d44a392a6f766b23cdf8cd.exe

Executes dropped EXE 1 IoCs

pid	Process
2316	290de93978d44a392a6f766b23cdf8cd.exe

Loads dropped DLL 1 IoCs

pid	Process
2204	290de93978d44a392a6f766b23cdf8cd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x0008000000012248-10.dat	upx
behavioral1/memory/2204-15-0x0000000003250000-0x0000000003562000-memory.dmp	upx
behavioral1/memory/2316-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2204	290de93978d44a392a6f766b23cdf8cd.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2204	290de93978d44a392a6f766b23cdf8cd.exe
2316	290de93978d44a392a6f766b23cdf8cd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2316	2204	290de93978d44a392a6f766b23cdf8cd.exe	29
PID 2204 wrote to memory of 2316	2204	290de93978d44a392a6f766b23cdf8cd.exe	29
PID 2204 wrote to memory of 2316	2204	290de93978d44a392a6f766b23cdf8cd.exe	29
PID 2204 wrote to memory of 2316	2204	290de93978d44a392a6f766b23cdf8cd.exe	29

C:\Users\Admin\AppData\Local\Temp\290de93978d44a392a6f766b23cdf8cd.exe
"C:\Users\Admin\AppData\Local\Temp\290de93978d44a392a6f766b23cdf8cd.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\290de93978d44a392a6f766b23cdf8cd.exe
  C:\Users\Admin\AppData\Local\Temp\290de93978d44a392a6f766b23cdf8cd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\290de93978d44a392a6f766b23cdf8cd.exe

Filesize
784KB

MD5
5cf5fb2774ac580c9c147dd426fc4512

SHA1
e5b14d5f25129fb4c782710c732887482da9c437

SHA256
6dc14fdac2e3fc8e5404a8c3d52e3293c15f228bea5b587ae45d9e64094af0cd

SHA512
eb1ffc6312ec031e204b561920a8807ce9ff831e56a2e1657fa38eff80c5bbaa1ecfa4e84752afeb9d6d7aa209e34528e17cbafe86d9ef25b2b813afae67faaf

Download Submit
memory/2204-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2204-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2204-3-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2204-15-0x0000000003250000-0x0000000003562000-memory.dmp

Filesize
3.1MB

Download
memory/2204-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2316-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2316-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2316-21-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2316-25-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2316-24-0x0000000003220000-0x00000000033B3000-memory.dmp

Filesize
1.6MB

Download
memory/2316-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download