xmrig | 388de88bdd7a04e719487b10de6103ded5c88e354f8c269e012901884ee7527d

General

Target

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
Size

6.4MB
MD5

2eafb4926d78feb0b61d5b995d0fe6ee
SHA1

f6e75678f1dafcb18408452ea948b9ad51b5d83e
SHA256

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30
SHA512

1885f5874c44a6841be4d53140ad63304e8d1924bb98fe14602d884fbc289ec8913db772a9e2db93e45298d1328700e2000ddab109af3964eaf6f23af61ef78e
SSDEEP

196608:1pznZ/ySos+NnrlQ5jrNoIgDJ0I6x/oAP:1pDZk9LQ5vNdeJ0IC

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2720-17-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-20-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-18-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-21-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-22-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-19-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-24-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-27-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-29-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-30-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-31-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-32-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-23-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-33-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-34-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2720-35-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exeiojmibhyhiws.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2660 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

iojmibhyhiws.exe

pid process

480
2560 iojmibhyhiws.exe
Loads dropped DLL 1 IoCs

Processes:

pid process

480

pid	process
2660	cmd.exe

pid	process
480
2560	iojmibhyhiws.exe

pid	process
480

Suspicious use of SetThreadContext 2 IoCs

Processes:

iojmibhyhiws.exe

description	pid	process	target process
PID 2560 set thread context of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 set thread context of 2720	2560	iojmibhyhiws.exe	conhost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2652 sc.exe
2640 sc.exe
2532 sc.exe
2572 sc.exe

pid	process
2652	sc.exe
2640	sc.exe
2532	sc.exe
2572	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exeiojmibhyhiws.execonhost.exe

pid	process
2020	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
2020	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
2020	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
2020	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
2020	50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
2560	iojmibhyhiws.exe
2560	iojmibhyhiws.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe
2720	conhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

conhost.exe

description pid process

Token: SeLockMemoryPrivilege 2720 conhost.exe

description	pid	process
Token: SeLockMemoryPrivilege	2720	conhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

cmd.exeiojmibhyhiws.exe

description	pid	process	target process
PID 2660 wrote to memory of 2844	2660	cmd.exe	choice.exe
PID 2660 wrote to memory of 2844	2660	cmd.exe	choice.exe
PID 2660 wrote to memory of 2844	2660	cmd.exe	choice.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2460	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe
PID 2560 wrote to memory of 2720	2560	iojmibhyhiws.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe
"C:\Users\Admin\AppData\Local\Temp\50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2020
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:2532
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:2844
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:2652
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:2640

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
1⤵
PID:2460

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
80KB

MD5
9a32c2577a92fd29bd9041eba85da151

SHA1
c3405384ab6a123d8f1ab017509c34148109c6cc

SHA256
3d5f39a8ec2f875f7b6c7f90c183442431f46952b8ae6783c93320453035c875

SHA512
b73fd28247bf46fa91fa713756bafcba53be24e4c2ba3d06caab1020fd13cd038a19c4a7539aea629cc7d7a7d211be68a14409f83d902017958af7f049502001

Download Submit
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
227KB

MD5
419e4ac515724ce6f3f4433997ae1ba3

SHA1
ad379a4a5d0ebde2cbc29e811d1757ad1a0a3111

SHA256
2bfff3181c1c8bae86a81c97037c14af71207b9ffdb6d4cc2a73c7f3bf6d515a

SHA512
e9414e42bf829dac68fb2bdd99b96884addad1aef8dfd43f95196272f7f7a70ae90d278527832533219c2edd202bf48acfd47836725539e6778257868545f56b

Download Submit
\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
442KB

MD5
6da813973436528ff05c5a06f8a935cd

SHA1
9e3c0b02bf5e91c92a259ab1cb610fe1b04b6708

SHA256
6b46dbc8ab5c06a1c26faae2c7bedc2e83e549633594768bc268457b9410a537

SHA512
88a485ce5937da12348236124896600e0363d794042fe8f42527909c8afe28173a061596a8550639a50893746bbbfbc744a25dc34ee590d5c0a619191de6b9b3

Download Submit
\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
233KB

MD5
a60d092d837b0288ab736af6a5d6d0a3

SHA1
5fc13b4502a2bf8174354e6d02ad8484d075bdc2

SHA256
ade3efbbe93b65d94d990db1a1266afcd5422737c4c85f65112979a6741f3b95

SHA512
95f5102d4b0c3597e695c7a46b33964489631cbbfbaefb077986c6558e768921f094df657c5d02a18689fd028e341b54919d9679139bab9906792f6bdc68847b

Download Submit
memory/2020-2-0x000000013F920000-0x000000014035D000-memory.dmp

Filesize
10.2MB

Download
memory/2020-0-0x000000013F920000-0x000000014035D000-memory.dmp

Filesize
10.2MB

Download
memory/2460-11-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2460-10-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2460-13-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2460-8-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2460-9-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2460-7-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2560-6-0x000000013F3A0000-0x000000013FDDD000-memory.dmp

Filesize
10.2MB

Download
memory/2560-26-0x000000013F3A0000-0x000000013FDDD000-memory.dmp

Filesize
10.2MB

Download
memory/2720-18-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-28-0x00000000000B0000-0x00000000000D0000-memory.dmp

Filesize
128KB

Download
memory/2720-17-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-21-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-22-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-19-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-24-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-27-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-16-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-20-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-29-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-30-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-31-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-32-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-23-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-33-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-34-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-35-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2720-36-0x0000000000170000-0x0000000000190000-memory.dmp

Filesize
128KB

Download
memory/2720-37-0x0000000000170000-0x0000000000190000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads