xmrig | 59624f7e1b91b1e76284eb0b6bb8d3697500e028aad500873315f9a7c1a2f2d6

Analysis

max time kernel
152s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51081b17dffbed2e34bb9c8d32b57f36.exe
Size

784KB
MD5

51081b17dffbed2e34bb9c8d32b57f36
SHA1

fc45090c654f14c06e3327035688e4e942dd2131
SHA256

59624f7e1b91b1e76284eb0b6bb8d3697500e028aad500873315f9a7c1a2f2d6
SHA512

27db61f8f4df5b9486989165dd87effedde796ddb544cce5aa13a5118547061f103009d82ef9801a2a381654a1b5728865fae9a455395789fd5572f68eb32a31
SSDEEP

12288:L/lP1gGIEQ0lQNsmQBySI7a6Nm/bd0cWrTZdNs9kuB2r+edLJh3BRD/AgxNIGUdL:LlPJlQ0laAyfAj+fnugr+wbD4fd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/536-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/536-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4492-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4492-20-0x0000000005500000-0x0000000005693000-memory.dmp	xmrig
behavioral2/memory/4492-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4492-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4492	51081b17dffbed2e34bb9c8d32b57f36.exe

Executes dropped EXE 1 IoCs

pid	Process
4492	51081b17dffbed2e34bb9c8d32b57f36.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/536-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000200000001e7e1-11.dat	upx
behavioral2/memory/4492-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
536	51081b17dffbed2e34bb9c8d32b57f36.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
536	51081b17dffbed2e34bb9c8d32b57f36.exe
4492	51081b17dffbed2e34bb9c8d32b57f36.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4492	536	51081b17dffbed2e34bb9c8d32b57f36.exe	92
PID 536 wrote to memory of 4492	536	51081b17dffbed2e34bb9c8d32b57f36.exe	92
PID 536 wrote to memory of 4492	536	51081b17dffbed2e34bb9c8d32b57f36.exe	92

C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe
"C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe
  C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\51081b17dffbed2e34bb9c8d32b57f36.exe

Filesize
784KB

MD5
cf645b0f7af6d844eb83d86beff8d9a7

SHA1
df4611197069cb126c46fe048768942cf662a742

SHA256
399aba14d950b1c04bb098ec728bdfeb37758a1f146d255d9afa1fad46c61c8b

SHA512
7b5617fc57bd2e4d6c971a059eea83eefb354787a37e9f89d01baff5c6826987deaca4a473153b087e49d969d9e393f75f78daf73ae66ee0edcb3b1d04acf795

Download Submit
memory/536-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/536-1-0x0000000001A30000-0x0000000001AF4000-memory.dmp

Filesize
784KB

Download
memory/536-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/536-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4492-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4492-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4492-14-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4492-20-0x0000000005500000-0x0000000005693000-memory.dmp

Filesize
1.6MB

Download
memory/4492-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4492-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download