xmrig | ae8a27d811fc904219e9f6658298826145637797e178a908cd1f4fdf49326433

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48b832d337203f131333fc242a5cb23e.exe
Size

784KB
MD5

48b832d337203f131333fc242a5cb23e
SHA1

83bd473e72339a36dd2d37b90fc93199d7109dc5
SHA256

ae8a27d811fc904219e9f6658298826145637797e178a908cd1f4fdf49326433
SHA512

a3ebf645c48b28df36b3e7cdba021e3d4c7079192851b4f2fa3f9d2629a874b0bb2e635bba181f5ecbb8c24dbef12b7fad4b9ae3c784109387bad46a0fb237a1
SSDEEP

24576:PtTEREnQ+MoIFdqd+FQ4Oae/1EYDR+YFkIJvOmi:PtIFdA+Zje/j1hJW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/3024-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/3024-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2572-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2572-24-0x0000000003100000-0x0000000003293000-memory.dmp	xmrig
behavioral1/memory/2572-25-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2572-34-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2572-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2572	48b832d337203f131333fc242a5cb23e.exe

Executes dropped EXE 1 IoCs

pid	Process
2572	48b832d337203f131333fc242a5cb23e.exe

Loads dropped DLL 1 IoCs

pid	Process
3024	48b832d337203f131333fc242a5cb23e.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x0003000000004ed5-10.dat	upx
behavioral1/memory/3024-15-0x00000000030E0000-0x00000000033F2000-memory.dmp	upx
behavioral1/memory/2572-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3024	48b832d337203f131333fc242a5cb23e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3024	48b832d337203f131333fc242a5cb23e.exe
2572	48b832d337203f131333fc242a5cb23e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2572	3024	48b832d337203f131333fc242a5cb23e.exe	30
PID 3024 wrote to memory of 2572	3024	48b832d337203f131333fc242a5cb23e.exe	30
PID 3024 wrote to memory of 2572	3024	48b832d337203f131333fc242a5cb23e.exe	30
PID 3024 wrote to memory of 2572	3024	48b832d337203f131333fc242a5cb23e.exe	30

C:\Users\Admin\AppData\Local\Temp\48b832d337203f131333fc242a5cb23e.exe
"C:\Users\Admin\AppData\Local\Temp\48b832d337203f131333fc242a5cb23e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\48b832d337203f131333fc242a5cb23e.exe
  C:\Users\Admin\AppData\Local\Temp\48b832d337203f131333fc242a5cb23e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\48b832d337203f131333fc242a5cb23e.exe

Filesize
784KB

MD5
6278a1e03aa93e9de804f14e67fc6c80

SHA1
4456321aecd7ea9c800cc3e94593147b8d4d73cf

SHA256
317dd43f8cf5d3c0c20694da52854fbf79e6fe2abb86a3caafa71cdc41757839

SHA512
76adb03434f19ac19d960e78e47da5517141c8b3238f2dd009565cb2df988281723bc9941bece4d5b1060fbdc41f6bea2531454cc654719b1547f53dbcbae8e7

Download Submit
memory/2572-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2572-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2572-19-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2572-24-0x0000000003100000-0x0000000003293000-memory.dmp

Filesize
1.6MB

Download
memory/2572-25-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2572-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2572-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3024-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3024-2-0x00000000002E0000-0x00000000003A4000-memory.dmp

Filesize
784KB

Download
memory/3024-15-0x00000000030E0000-0x00000000033F2000-memory.dmp

Filesize
3.1MB

Download
memory/3024-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3024-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download