xmrig | 1b6f3fa1c016ce89743cb0045de4046d96fad48792fe876fec95719cd9e2c4fa

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06792dc561e6e09634eb31a013ab40a2.exe
Size

1.5MB
MD5

06792dc561e6e09634eb31a013ab40a2
SHA1

3914c5f7cbf36bef3249c3b66f1e4a3694a7f036
SHA256

1b6f3fa1c016ce89743cb0045de4046d96fad48792fe876fec95719cd9e2c4fa
SHA512

a5c629aebb9d5ca8669e3d58538635cd501f66b6aba786b5efbcbed9bcb2705cdfbccf769569f051d13fcd24456da98c7099143e225f31574cab0a8cb58d3318
SSDEEP

49152:SF8M6WvOv84a4uvt+2S8Cnjf9p91H0jR+pXEK:kOvqF+j8UjA+WK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/1876-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1876-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4328-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4328-20-0x00000000053D0000-0x0000000005563000-memory.dmp	xmrig
behavioral2/memory/4328-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4328-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4328	06792dc561e6e09634eb31a013ab40a2.exe

Executes dropped EXE 1 IoCs

pid	Process
4328	06792dc561e6e09634eb31a013ab40a2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1876-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0007000000023108-11.dat	upx
behavioral2/memory/4328-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1876	06792dc561e6e09634eb31a013ab40a2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1876	06792dc561e6e09634eb31a013ab40a2.exe
4328	06792dc561e6e09634eb31a013ab40a2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4328	1876	06792dc561e6e09634eb31a013ab40a2.exe	90
PID 1876 wrote to memory of 4328	1876	06792dc561e6e09634eb31a013ab40a2.exe	90
PID 1876 wrote to memory of 4328	1876	06792dc561e6e09634eb31a013ab40a2.exe	90

C:\Users\Admin\AppData\Local\Temp\06792dc561e6e09634eb31a013ab40a2.exe
"C:\Users\Admin\AppData\Local\Temp\06792dc561e6e09634eb31a013ab40a2.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\06792dc561e6e09634eb31a013ab40a2.exe
  C:\Users\Admin\AppData\Local\Temp\06792dc561e6e09634eb31a013ab40a2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\06792dc561e6e09634eb31a013ab40a2.exe

Filesize
784KB

MD5
5d62d8f3f96d438236f7bd8cc4eed947

SHA1
da54d3b1cb3cd218ed0386dd2d2ba9d7463e47a2

SHA256
9d80ad2d5beb6911e5f7ac0b48af15765d3c1524120a079b1ab34c91d04b33a1

SHA512
2ce836d53279412555ff6e7d00eec781094ad9c034f5c7a2f74c8212f21d160103726efb6947da5bfe07d2a42bb21aee88cfcc8335c6fbd2843cc71d187194e7

Download Submit
memory/1876-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1876-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/1876-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1876-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4328-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4328-14-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4328-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4328-20-0x00000000053D0000-0x0000000005563000-memory.dmp

Filesize
1.6MB

Download
memory/4328-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4328-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download