xmrig | 50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30

Analysis

max time kernel
299s
max time network
305s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
01-01-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
Size

6.4MB
MD5

2eafb4926d78feb0b61d5b995d0fe6ee
SHA1

f6e75678f1dafcb18408452ea948b9ad51b5d83e
SHA256

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30
SHA512

1885f5874c44a6841be4d53140ad63304e8d1924bb98fe14602d884fbc289ec8913db772a9e2db93e45298d1328700e2000ddab109af3964eaf6f23af61ef78e
SSDEEP

196608:1pznZ/ySos+NnrlQ5jrNoIgDJ0I6x/oAP:1pDZk9LQ5vNdeJ0IC

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4712-15-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-16-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-17-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-18-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-19-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-20-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-21-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-22-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-25-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-27-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-28-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-30-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-29-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-31-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-35-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-36-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-39-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-40-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-41-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/4712-42-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

iojmibhyhiws.exe50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe

Executes dropped EXE 1 IoCs

Processes:

iojmibhyhiws.exe

pid process

3524 iojmibhyhiws.exe

pid	process
3524	iojmibhyhiws.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

iojmibhyhiws.exe

description	pid	process	target process
PID 3524 set thread context of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 set thread context of 4712	3524	iojmibhyhiws.exe	conhost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

3248 sc.exe
3160 sc.exe
2760 sc.exe
2744 sc.exe

pid	process
3248	sc.exe
3160	sc.exe
2760	sc.exe
2744	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exeiojmibhyhiws.execonhost.exe

pid	process
208	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
208	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
208	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
208	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
208	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
3524	iojmibhyhiws.exe
3524	iojmibhyhiws.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe
4712	conhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

conhost.exe

description pid process

Token: SeLockMemoryPrivilege 4712 conhost.exe

pid	process
644

description	pid	process
Token: SeLockMemoryPrivilege	4712	conhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

cmd.exeiojmibhyhiws.exe

description	pid	process	target process
PID 4908 wrote to memory of 4764	4908	cmd.exe	choice.exe
PID 4908 wrote to memory of 4764	4908	cmd.exe	choice.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 3052	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe
PID 3524 wrote to memory of 4712	3524	iojmibhyhiws.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
"C:\Users\Admin\AppData\Local\Temp\50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:208
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:2760
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4764
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:3160

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3052
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
712KB

MD5
d375ee2a700cf63b46061ecf5d91694b

SHA1
b43061b185e1cfe7df22d645de07a3d461edeaaf

SHA256
53a2c3021257ad06c97dad6cb691d018d2b4ae3756437ea87bc5537a9470b767

SHA512
83ec310e5c8d3689c87e4ca339de6251aef9f323ddd0331039fc558eb025fb9eecee2c2e94b2add8eecfaa97301e2819dad6399f95bb2ee382b08b1ac5666499

Download Submit
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
753KB

MD5
74419ae75c20e475c3999c8f9c702397

SHA1
50d544d2b454d2e94a45703286d423cb2638673b

SHA256
5742f907c00cc7753c1cddf0570f25993c0a9d9739e1a87a79d9456dc200a9ba

SHA512
3ceaaecfe541ac211e9e4dd90e1000172f5a37907c18b44fb1bb47606276f2272b144b06f83b23cbd839ada32d937fc8df0668eb05bc3210d71ff3e5972ea787

Download Submit
memory/208-0-0x00007FF645B50000-0x00007FF64658D000-memory.dmp

Filesize
10.2MB

Download
memory/208-2-0x00007FF645B50000-0x00007FF64658D000-memory.dmp

Filesize
10.2MB

Download
memory/3052-6-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3052-10-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3052-9-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3052-13-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3052-8-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3052-7-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3524-5-0x00007FF6A84D0000-0x00007FF6A8F0D000-memory.dmp

Filesize
10.2MB

Download
memory/3524-24-0x00007FF6A84D0000-0x00007FF6A8F0D000-memory.dmp

Filesize
10.2MB

Download
memory/4712-25-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-31-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-17-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-18-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-19-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-20-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-21-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-22-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-15-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-14-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-27-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-26-0x000002AFE03A0000-0x000002AFE03C0000-memory.dmp

Filesize
128KB

Download
memory/4712-28-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-30-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-29-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-16-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-34-0x000002AFE0950000-0x000002AFE0990000-memory.dmp

Filesize
256KB

Download
memory/4712-35-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-36-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-37-0x000002AFE0990000-0x000002AFE09B0000-memory.dmp

Filesize
128KB

Download
memory/4712-38-0x000002AFE0990000-0x000002AFE09B0000-memory.dmp

Filesize
128KB

Download
memory/4712-39-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-40-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-41-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-44-0x000002AFE09B0000-0x000002AFE09D0000-memory.dmp

Filesize
128KB

Download
memory/4712-43-0x000002AFE0990000-0x000002AFE09B0000-memory.dmp

Filesize
128KB

Download
memory/4712-42-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4712-45-0x000002AFE0990000-0x000002AFE09B0000-memory.dmp

Filesize
128KB

Download
memory/4712-46-0x000002AFE09B0000-0x000002AFE09D0000-memory.dmp

Filesize
128KB

Download