xmrig | 5db2dbdcd02c2dfb7e88eaac3ed576462f3be79121aee895fc107f307c1b9dfc

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a3b20139c1c8ee89f8277fa2b7776ee.exe
Size

784KB
MD5

5a3b20139c1c8ee89f8277fa2b7776ee
SHA1

e5b1ccd32632883c5d96832dceba774b8d056f5e
SHA256

5db2dbdcd02c2dfb7e88eaac3ed576462f3be79121aee895fc107f307c1b9dfc
SHA512

da2b583f1b9c0d2122055423c6ddaea184e7a1f3869fba1b2c8635935bd3a1825c4bd4b87d3ed4567d8b5c0379fff04b33f571f5d3f074907c530562739f8c32
SSDEEP

24576:Qhv0v+NxfOKjjwyW+Vj5grXzu+UtE9snusjawr:K0WOd+Vj5grXzuV69susjaw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4124-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4124-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2248-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2248-20-0x00000000053D0000-0x0000000005563000-memory.dmp	xmrig
behavioral2/memory/2248-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2248-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2248	5a3b20139c1c8ee89f8277fa2b7776ee.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	5a3b20139c1c8ee89f8277fa2b7776ee.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4124-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000600000002323e-11.dat	upx
behavioral2/memory/2248-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4124	5a3b20139c1c8ee89f8277fa2b7776ee.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4124	5a3b20139c1c8ee89f8277fa2b7776ee.exe
2248	5a3b20139c1c8ee89f8277fa2b7776ee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2248	4124	5a3b20139c1c8ee89f8277fa2b7776ee.exe	66
PID 4124 wrote to memory of 2248	4124	5a3b20139c1c8ee89f8277fa2b7776ee.exe	66
PID 4124 wrote to memory of 2248	4124	5a3b20139c1c8ee89f8277fa2b7776ee.exe	66

C:\Users\Admin\AppData\Local\Temp\5a3b20139c1c8ee89f8277fa2b7776ee.exe
"C:\Users\Admin\AppData\Local\Temp\5a3b20139c1c8ee89f8277fa2b7776ee.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\5a3b20139c1c8ee89f8277fa2b7776ee.exe
  C:\Users\Admin\AppData\Local\Temp\5a3b20139c1c8ee89f8277fa2b7776ee.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5a3b20139c1c8ee89f8277fa2b7776ee.exe

Filesize
1KB

MD5
f03e52a5e70c32847f9f68511dda3fbe

SHA1
8eed6efe462af9d5c9852947a67870c123acf76e

SHA256
195bb62ac731d244631d6193145263985acf04939e18e42b47d72a5254dc3823

SHA512
b7054c504a917b966ed1780036f729cd573da8f6f59c59dfcaa5693accb452e4545a35b9dad62c64e6fa20eb86330ae38d704018b0517984c4776426784f3f66

Download Submit
memory/2248-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2248-15-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2248-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2248-20-0x00000000053D0000-0x0000000005563000-memory.dmp

Filesize
1.6MB

Download
memory/2248-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2248-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4124-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4124-1-0x00000000019E0000-0x0000000001AA4000-memory.dmp

Filesize
784KB

Download
memory/4124-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4124-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download