xmrig | 59624f7e1b91b1e76284eb0b6bb8d3697500e028aad500873315f9a7c1a2f2d6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51081b17dffbed2e34bb9c8d32b57f36.exe
Size

784KB
MD5

51081b17dffbed2e34bb9c8d32b57f36
SHA1

fc45090c654f14c06e3327035688e4e942dd2131
SHA256

59624f7e1b91b1e76284eb0b6bb8d3697500e028aad500873315f9a7c1a2f2d6
SHA512

27db61f8f4df5b9486989165dd87effedde796ddb544cce5aa13a5118547061f103009d82ef9801a2a381654a1b5728865fae9a455395789fd5572f68eb32a31
SSDEEP

12288:L/lP1gGIEQ0lQNsmQBySI7a6Nm/bd0cWrTZdNs9kuB2r+edLJh3BRD/AgxNIGUdL:LlPJlQ0laAyfAj+fnugr+wbD4fd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral1/memory/2468-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2128-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2128-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2468-16-0x0000000003230000-0x0000000003542000-memory.dmp	xmrig
behavioral1/memory/2468-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2128	51081b17dffbed2e34bb9c8d32b57f36.exe

Executes dropped EXE 1 IoCs

pid	Process
2128	51081b17dffbed2e34bb9c8d32b57f36.exe

Loads dropped DLL 1 IoCs

pid	Process
2468	51081b17dffbed2e34bb9c8d32b57f36.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2468-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2468	51081b17dffbed2e34bb9c8d32b57f36.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2468	51081b17dffbed2e34bb9c8d32b57f36.exe
2128	51081b17dffbed2e34bb9c8d32b57f36.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2128	2468	51081b17dffbed2e34bb9c8d32b57f36.exe	18
PID 2468 wrote to memory of 2128	2468	51081b17dffbed2e34bb9c8d32b57f36.exe	18
PID 2468 wrote to memory of 2128	2468	51081b17dffbed2e34bb9c8d32b57f36.exe	18
PID 2468 wrote to memory of 2128	2468	51081b17dffbed2e34bb9c8d32b57f36.exe	18

C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe
"C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe
  C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-19-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2128-26-0x00000000030D0000-0x0000000003263000-memory.dmp

Filesize
1.6MB

Download
memory/2128-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2128-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2128-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2128-21-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2128-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2468-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2468-3-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2468-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2468-16-0x0000000003230000-0x0000000003542000-memory.dmp

Filesize
3.1MB

Download
memory/2468-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download