xmrig | 94937da57f8e0d8bae0b95cefe7919682218ede56838ff691da2c634b2af9757

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:43

Target

74ff85ae44ab6475c8abf7a36325b6c6.exe
Size

2.3MB
MD5

74ff85ae44ab6475c8abf7a36325b6c6
SHA1

38a271a47f3fdc2a526c5b3409963d26a4592aaa
SHA256

94937da57f8e0d8bae0b95cefe7919682218ede56838ff691da2c634b2af9757
SHA512

6562b89781973628ed84a177c113f6779dd18e19b2125453b4d7f1279234ce6d274909c621378997216e8384d34c5dd510cce694be5008a3ac20dffc54fed66a
SSDEEP

49152:nGBgFzrU414Iu2MwjVqL8eWJ24KPQA4bVlAfsmifeaVTpN0E:nGBgj4MjjIBa2nQA4AkmRON0

Score

10^/10

xmrig miner upx

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/3040-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/3040-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/3040-14-0x00000000034F0000-0x0000000003802000-memory.dmp	xmrig
behavioral1/memory/2664-19-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2664-24-0x0000000003220000-0x00000000033B3000-memory.dmp	xmrig
behavioral1/memory/2664-25-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2664-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

Processes:

74ff85ae44ab6475c8abf7a36325b6c6.exe

pid process

2664 74ff85ae44ab6475c8abf7a36325b6c6.exe
Executes dropped EXE 1 IoCs

Processes:

74ff85ae44ab6475c8abf7a36325b6c6.exe

pid process

2664 74ff85ae44ab6475c8abf7a36325b6c6.exe
Loads dropped DLL 1 IoCs

Processes:

74ff85ae44ab6475c8abf7a36325b6c6.exe

pid process

3040 74ff85ae44ab6475c8abf7a36325b6c6.exe

pid	process
2664	74ff85ae44ab6475c8abf7a36325b6c6.exe

pid	process
2664	74ff85ae44ab6475c8abf7a36325b6c6.exe

pid	process
3040	74ff85ae44ab6475c8abf7a36325b6c6.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\74ff85ae44ab6475c8abf7a36325b6c6.exe	upx
behavioral1/memory/2664-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

74ff85ae44ab6475c8abf7a36325b6c6.exe

pid process

3040 74ff85ae44ab6475c8abf7a36325b6c6.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

74ff85ae44ab6475c8abf7a36325b6c6.exe74ff85ae44ab6475c8abf7a36325b6c6.exe

pid process

3040 74ff85ae44ab6475c8abf7a36325b6c6.exe
2664 74ff85ae44ab6475c8abf7a36325b6c6.exe

pid	process
3040	74ff85ae44ab6475c8abf7a36325b6c6.exe

pid	process
3040	74ff85ae44ab6475c8abf7a36325b6c6.exe
2664	74ff85ae44ab6475c8abf7a36325b6c6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74ff85ae44ab6475c8abf7a36325b6c6.exe

description	pid	process	target process
PID 3040 wrote to memory of 2664	3040	74ff85ae44ab6475c8abf7a36325b6c6.exe	74ff85ae44ab6475c8abf7a36325b6c6.exe
PID 3040 wrote to memory of 2664	3040	74ff85ae44ab6475c8abf7a36325b6c6.exe	74ff85ae44ab6475c8abf7a36325b6c6.exe
PID 3040 wrote to memory of 2664	3040	74ff85ae44ab6475c8abf7a36325b6c6.exe	74ff85ae44ab6475c8abf7a36325b6c6.exe
PID 3040 wrote to memory of 2664	3040	74ff85ae44ab6475c8abf7a36325b6c6.exe	74ff85ae44ab6475c8abf7a36325b6c6.exe

C:\Users\Admin\AppData\Local\Temp\74ff85ae44ab6475c8abf7a36325b6c6.exe

Filesize
784KB

MD5
aaa6a4cdf529af4eee5afea8e38d4c8e

SHA1
2ab37c4c8fc0f166a67eb33c0cf559bbb89eba98

SHA256
aa2e41a6f1a85f16cdfac43643c1164c19dee497581adfabc0031746fd931ade

SHA512
35c56775fb0dd7add916e5b60a79f920e8cd50cbdb87a99b526c35920624e30a10588bd18dfa219646d76f91f5d8706c8fd56547fe77977007de2eb7abc68e01

Download Submit
memory/2664-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2664-18-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2664-19-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2664-24-0x0000000003220000-0x00000000033B3000-memory.dmp

Filesize
1.6MB

Download
memory/2664-25-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2664-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3040-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3040-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3040-3-0x00000000002A0000-0x0000000000364000-memory.dmp

Filesize
784KB

Download
memory/3040-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3040-14-0x00000000034F0000-0x0000000003802000-memory.dmp

Filesize
3.1MB

Download