xmrig | 0217ff82ab6d55036e041c294968eae2f23dfbac4ab055fe83f0ca9e6c8f60c8

Analysis

max time kernel
133s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c05af5a8e4330ab6ec3adab0fb63f0e.exe
Size

784KB
MD5

4c05af5a8e4330ab6ec3adab0fb63f0e
SHA1

a2bf44c6a4d8bc83f5340adccad82a2054aca9d5
SHA256

0217ff82ab6d55036e041c294968eae2f23dfbac4ab055fe83f0ca9e6c8f60c8
SHA512

70d3ce9b2f21c56d446307056b8c6f4c86b34ed391d6008ea5bea149eb1a9c646e4fb4644f977219be681589ffdc52fa1f653faa451579cfa7f0431ecd9c0311
SSDEEP

12288:1A6eP3K6P/GPqp4aM9AfFR1qJjTt2Vm67DBhsmjFd/0Lnn9oQYZV1O0:1Al3KUkqV1qJjTt2VmWY0B0T9oQE17

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4536-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4536-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3728-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3728-21-0x0000000005470000-0x0000000005603000-memory.dmp	xmrig
behavioral2/memory/3728-22-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3728-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3728	4c05af5a8e4330ab6ec3adab0fb63f0e.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	4c05af5a8e4330ab6ec3adab0fb63f0e.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000600000001e0ce-12.dat	upx
behavioral2/memory/3728-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4536	4c05af5a8e4330ab6ec3adab0fb63f0e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4536	4c05af5a8e4330ab6ec3adab0fb63f0e.exe
3728	4c05af5a8e4330ab6ec3adab0fb63f0e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3728	4536	4c05af5a8e4330ab6ec3adab0fb63f0e.exe	91
PID 4536 wrote to memory of 3728	4536	4c05af5a8e4330ab6ec3adab0fb63f0e.exe	91
PID 4536 wrote to memory of 3728	4536	4c05af5a8e4330ab6ec3adab0fb63f0e.exe	91

C:\Users\Admin\AppData\Local\Temp\4c05af5a8e4330ab6ec3adab0fb63f0e.exe
"C:\Users\Admin\AppData\Local\Temp\4c05af5a8e4330ab6ec3adab0fb63f0e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\4c05af5a8e4330ab6ec3adab0fb63f0e.exe
  C:\Users\Admin\AppData\Local\Temp\4c05af5a8e4330ab6ec3adab0fb63f0e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4c05af5a8e4330ab6ec3adab0fb63f0e.exe

Filesize
784KB

MD5
d7cbe93d47935b1d7e70fbc7a4b9bbf7

SHA1
5900ca0d75e76391deb0cd017c5c97124157c182

SHA256
00833e7bfee269b9ab57fc5a3132b3cf06fb7f4810e55e226a1ec26372ea2fae

SHA512
a32c1fb99f057b2624fbd74a91c9dc1421f5bd9335da14c7931b91ec136c7a6d8a5bb992b5e94fd39f6f5e3ef010f47cdaec75c97090ed02af689b5928d9d390

Download Submit
memory/3728-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3728-16-0x00000000018D0000-0x0000000001994000-memory.dmp

Filesize
784KB

Download
memory/3728-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3728-21-0x0000000005470000-0x0000000005603000-memory.dmp

Filesize
1.6MB

Download
memory/3728-22-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3728-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4536-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4536-1-0x00000000019C0000-0x0000000001A84000-memory.dmp

Filesize
784KB

Download
memory/4536-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4536-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download