xmrig | 143d30dd469de38126c66fafcb9a0efa3394caba1705b7654ada1afda2da270a

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684a09c062742f6032ea7f8b4a642d3d.exe
Size

784KB
MD5

684a09c062742f6032ea7f8b4a642d3d
SHA1

343f8bb1b913c8b9417458dc8e432a0ce1b51526
SHA256

143d30dd469de38126c66fafcb9a0efa3394caba1705b7654ada1afda2da270a
SHA512

e27d73a265eb43405a0b45f00869dc9502186722b40580c361ea2e51cb29aebee5db0032611f5bdd6a36efa53cab9d9a77691e5dce2886929175b3ac883172b9
SSDEEP

24576:Bto8plYP6wbGpa5KyohY5EwFna016cvsmKHe:Ho8HO6IGij78CvS+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3048-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3048-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2796-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2796-21-0x00000000053C0000-0x0000000005553000-memory.dmp	xmrig
behavioral2/memory/2796-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2796-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2796	684a09c062742f6032ea7f8b4a642d3d.exe

Executes dropped EXE 1 IoCs

pid	Process
2796	684a09c062742f6032ea7f8b4a642d3d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3048-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0007000000023204-11.dat	upx
behavioral2/memory/2796-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3048	684a09c062742f6032ea7f8b4a642d3d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3048	684a09c062742f6032ea7f8b4a642d3d.exe
2796	684a09c062742f6032ea7f8b4a642d3d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2796	3048	684a09c062742f6032ea7f8b4a642d3d.exe	89
PID 3048 wrote to memory of 2796	3048	684a09c062742f6032ea7f8b4a642d3d.exe	89
PID 3048 wrote to memory of 2796	3048	684a09c062742f6032ea7f8b4a642d3d.exe	89

C:\Users\Admin\AppData\Local\Temp\684a09c062742f6032ea7f8b4a642d3d.exe
"C:\Users\Admin\AppData\Local\Temp\684a09c062742f6032ea7f8b4a642d3d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\684a09c062742f6032ea7f8b4a642d3d.exe
  C:\Users\Admin\AppData\Local\Temp\684a09c062742f6032ea7f8b4a642d3d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\684a09c062742f6032ea7f8b4a642d3d.exe

Filesize
443KB

MD5
3c189867cc0cbc7eff2a53b9b58f1023

SHA1
307c30befe7f98f837e8ea2e2ae59b96de71a79f

SHA256
517aa85e089dbdfec1c56c288e47e76782dcfdc7019d653469e11e706aa44729

SHA512
7eeb6d55b2619cdc61c5a193af1f897907e7bc9b60725e2efe2b969567c1a235f3e61e053d4d8ead74be5e558da724ea27daeddaae321bebcbedf314bca3172b

Download Submit
memory/2796-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2796-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2796-14-0x00000000018C0000-0x0000000001984000-memory.dmp

Filesize
784KB

Download
memory/2796-21-0x00000000053C0000-0x0000000005553000-memory.dmp

Filesize
1.6MB

Download
memory/2796-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2796-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3048-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3048-1-0x0000000001A80000-0x0000000001B44000-memory.dmp

Filesize
784KB

Download
memory/3048-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3048-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download