xmrig | 50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30

General

Target

SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
Size

6.4MB
MD5

2eafb4926d78feb0b61d5b995d0fe6ee
SHA1

f6e75678f1dafcb18408452ea948b9ad51b5d83e
SHA256

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30
SHA512

1885f5874c44a6841be4d53140ad63304e8d1924bb98fe14602d884fbc289ec8913db772a9e2db93e45298d1328700e2000ddab109af3964eaf6f23af61ef78e
SSDEEP

196608:1pznZ/ySos+NnrlQ5jrNoIgDJ0I6x/oAP:1pDZk9LQ5vNdeJ0IC

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1896-15-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-17-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-18-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-20-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-21-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-22-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-19-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-16-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-24-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-28-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-29-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-30-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-31-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-27-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-33-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/1896-34-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Win64.Evo-gen.19506.21561.exeiojmibhyhiws.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe

Executes dropped EXE 1 IoCs

Processes:

iojmibhyhiws.exe

pid process

3076 iojmibhyhiws.exe

pid	process
3076	iojmibhyhiws.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

iojmibhyhiws.exe

description	pid	process	target process
PID 3076 set thread context of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 set thread context of 1896	3076	iojmibhyhiws.exe	conhost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1760 sc.exe
1392 sc.exe
4316 sc.exe
1708 sc.exe

pid	process
1760	sc.exe
1392	sc.exe
4316	sc.exe
1708	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SecuriteInfo.com.Win64.Evo-gen.19506.21561.exeiojmibhyhiws.execonhost.exe

pid	process
2020	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
2020	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
2020	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
2020	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
2020	SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
3076	iojmibhyhiws.exe
3076	iojmibhyhiws.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe
1896	conhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

conhost.exe

description pid process

Token: SeLockMemoryPrivilege 1896 conhost.exe

description	pid	process
Token: SeLockMemoryPrivilege	1896	conhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

cmd.exeiojmibhyhiws.exe

description	pid	process	target process
PID 2324 wrote to memory of 2916	2324	cmd.exe	choice.exe
PID 2324 wrote to memory of 2916	2324	cmd.exe	choice.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 3064	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe
PID 3076 wrote to memory of 1896	3076	iojmibhyhiws.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2020
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.19506.21561.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2916
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:1392
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:4316
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:1708

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
180KB

MD5
c1e3e4110ab7c7ef6d0b9d55769c153d

SHA1
94708ee0988d8cf9fff87e8f1a9e5718988f5e71

SHA256
594ac40adecacef983600a31613dc10c5d97261014ce30fc42c43a1fe59286ce

SHA512
8d2035817e5fd33a65aa5eca8193420f1958a377634fa29fb71368f6884d4225e92a2faf12f249a8812d509e15731fc331275e0a77868dfff53ee364d427f712

Download Submit
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
144KB

MD5
bb8ff216820c5ed981285493e5c96e83

SHA1
d7bca89fb66d3ed815656c1501f623cd76f46f0d

SHA256
0eff591e859382cfabe9e75697967d010d723c8b48146549dac59f4d242ee752

SHA512
4d88b39c2da31f3e1b3e1a12d2c449868c4927d5e9d1fa5bee875bd8671dc95e30d422feeffdcc9c29d6c7a4f5ee976884ebc05c9ab881659d88b94d44bd0540

Download Submit
memory/1896-26-0x000001D918020000-0x000001D918040000-memory.dmp

Filesize
128KB

Download
memory/1896-36-0x000001D918710000-0x000001D918730000-memory.dmp

Filesize
128KB

Download
memory/1896-35-0x000001D918710000-0x000001D918730000-memory.dmp

Filesize
128KB

Download
memory/1896-15-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-17-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-18-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-20-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-21-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-22-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-19-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-16-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-14-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-24-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-34-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-33-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-32-0x000001D9186F0000-0x000001D918710000-memory.dmp

Filesize
128KB

Download
memory/1896-27-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-31-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-30-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-29-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/1896-28-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2020-2-0x00007FF6A8D60000-0x00007FF6A979D000-memory.dmp

Filesize
10.2MB

Download
memory/2020-0-0x00007FF6A8D60000-0x00007FF6A979D000-memory.dmp

Filesize
10.2MB

Download
memory/3064-7-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3064-6-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3064-8-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3064-9-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3064-13-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3064-10-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3076-5-0x00007FF7F37C0000-0x00007FF7F41FD000-memory.dmp

Filesize
10.2MB

Download
memory/3076-25-0x00007FF7F37C0000-0x00007FF7F41FD000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads