xmrig | 50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30

General

Target

tmp.exe
Size

6.4MB
MD5

2eafb4926d78feb0b61d5b995d0fe6ee
SHA1

f6e75678f1dafcb18408452ea948b9ad51b5d83e
SHA256

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30
SHA512

1885f5874c44a6841be4d53140ad63304e8d1924bb98fe14602d884fbc289ec8913db772a9e2db93e45298d1328700e2000ddab109af3964eaf6f23af61ef78e
SSDEEP

196608:1pznZ/ySos+NnrlQ5jrNoIgDJ0I6x/oAP:1pDZk9LQ5vNdeJ0IC

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2524-18-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-19-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-20-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-17-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-22-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-23-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-21-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-24-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-27-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-29-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-30-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-31-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-33-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-32-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-34-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2524-35-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

iojmibhyhiws.exetmp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2648 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

iojmibhyhiws.exe

pid process

480
2700 iojmibhyhiws.exe
Loads dropped DLL 1 IoCs

Processes:

pid process

480

pid	process
2648	cmd.exe

pid	process
480
2700	iojmibhyhiws.exe

pid	process
480

Suspicious use of SetThreadContext 2 IoCs

Processes:

iojmibhyhiws.exe

description	pid	process	target process
PID 2700 set thread context of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 set thread context of 2524	2700	iojmibhyhiws.exe	conhost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2644 sc.exe
2596 sc.exe
3008 sc.exe
2116 sc.exe

pid	process
2644	sc.exe
2596	sc.exe
3008	sc.exe
2116	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

tmp.exeiojmibhyhiws.execonhost.exe

pid	process
2412	tmp.exe
2412	tmp.exe
2412	tmp.exe
2412	tmp.exe
2412	tmp.exe
2700	iojmibhyhiws.exe
2700	iojmibhyhiws.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe
2524	conhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

conhost.exe

description pid process

Token: SeLockMemoryPrivilege 2524 conhost.exe

description	pid	process
Token: SeLockMemoryPrivilege	2524	conhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

cmd.exeiojmibhyhiws.exe

description	pid	process	target process
PID 2648 wrote to memory of 2852	2648	cmd.exe	choice.exe
PID 2648 wrote to memory of 2852	2648	cmd.exe	choice.exe
PID 2648 wrote to memory of 2852	2648	cmd.exe	choice.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2504	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe
PID 2700 wrote to memory of 2524	2700	iojmibhyhiws.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2412
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:3008
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2648
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:2644
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:2596

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2504
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2524

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
200KB

MD5
a940332205774a48af473ca4ad7358c2

SHA1
67f96cca83e834d3bbdedce189f7aa5e7e02e9d1

SHA256
d208cccc8a93721265cc52654d2c92f47d8c648fb901b94268cfaf47d3dd5c83

SHA512
1f67a55786f70bcba81f09af04543f56c1d3dbb4cc472b29ece8352900f4f3524ad9993e5c4c55354f03ddd399198f85109b264a9f03a1f493b5c50e9af49a81

Download Submit
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
481KB

MD5
a93aadb8946880fff16fdd93fabd2a56

SHA1
d3f872f350077a358bc199dfac2c007bfefedc4c

SHA256
2b30c09d66cb3a9bc024ec4b31358d70c8f502f0808b36d6b1458b7d2d19cf68

SHA512
6fc839e6f14c73559beb573fa032d80bd164fb4a6ff9053b7f856291fc3a57463476039e3c40db31ca61f3b30782374269da4550fc57a3177cc7a2839242d6b2

Download Submit
\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
402KB

MD5
7bf73a3e3729b9b686c4b92d77737b24

SHA1
8b8338831d8c41f2584b59db9ecd35c60172b8bc

SHA256
561c9b6d0c8962894235f630a7397056efd451e8f302a1e37df4988f26f97bc9

SHA512
7c515277edbc1da670f6239771248629f3d7abc19a4d7a32fe52fa0727acf223854059f9deb75014c6da9c142aad1b91a8c9f06a4bf1b5e115d8100920f194ff

Download Submit
\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
247KB

MD5
fbcd298ed092ecc835aec2c085468059

SHA1
961b81aad855946f13f02a5d3ae998b76ccaa24f

SHA256
402f15b6c24eaf33687c771a82708d185b17813abd8f08230ef6db35487673f6

SHA512
7e42d08c3f5aff4f7431f9bc20ce0e26afd2b541717228b24d9b825433225f0de975ea46386b1247dcc2e5d3fee046fe8affd16b43001c311975d8d5e48e9fd3

Download Submit
memory/2412-2-0x000000013FC90000-0x00000001406CD000-memory.dmp

Filesize
10.2MB

Download
memory/2412-0-0x000000013FC90000-0x00000001406CD000-memory.dmp

Filesize
10.2MB

Download
memory/2504-9-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2504-7-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2504-13-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2504-11-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2504-10-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2504-8-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2524-16-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-31-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-23-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-21-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-17-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-24-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-27-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-28-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/2524-37-0x00000000004C0000-0x00000000004E0000-memory.dmp

Filesize
128KB

Download
memory/2524-29-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-30-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-22-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-33-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-32-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-20-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-19-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-18-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-36-0x00000000004C0000-0x00000000004E0000-memory.dmp

Filesize
128KB

Download
memory/2524-34-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2524-35-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2700-6-0x000000013F7C0000-0x00000001401FD000-memory.dmp

Filesize
10.2MB

Download
memory/2700-26-0x000000013F7C0000-0x00000001401FD000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads