xmrig | 15623c33785507a082a25846321c2592eac4f6f4b2205853c0460e46cf5cf3d5

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ae7e34678179db6c0c58fd57af9e643.exe
Size

784KB
MD5

8ae7e34678179db6c0c58fd57af9e643
SHA1

f6af949692f4dc09f21546223c2d065c32f2cccf
SHA256

15623c33785507a082a25846321c2592eac4f6f4b2205853c0460e46cf5cf3d5
SHA512

abf03125234c92cda114e04001475903c4e568c1436c385fa22fa3348a54b47292e7cecc31e2d2521756a9587bfac6c09d3a8978e42dad888080f6cf08209ebb
SSDEEP

12288:bJxIF1sO9llCmo3dQiMdGzfDtvV2tSLvrxhCZUrPREmfyvb8+l0L8aRGv0:H0s2lCmfiMdGzfDtvcm9HExd6Qagv0

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2772-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2772-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3676-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3676-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3676-22-0x0000000005410000-0x00000000055A3000-memory.dmp	xmrig
behavioral2/memory/3676-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3676	8ae7e34678179db6c0c58fd57af9e643.exe

Executes dropped EXE 1 IoCs

pid	Process
3676	8ae7e34678179db6c0c58fd57af9e643.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2772-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000700000002320c-11.dat	upx
behavioral2/memory/3676-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2772	8ae7e34678179db6c0c58fd57af9e643.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2772	8ae7e34678179db6c0c58fd57af9e643.exe
3676	8ae7e34678179db6c0c58fd57af9e643.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3676	2772	8ae7e34678179db6c0c58fd57af9e643.exe	86
PID 2772 wrote to memory of 3676	2772	8ae7e34678179db6c0c58fd57af9e643.exe	86
PID 2772 wrote to memory of 3676	2772	8ae7e34678179db6c0c58fd57af9e643.exe	86

C:\Users\Admin\AppData\Local\Temp\8ae7e34678179db6c0c58fd57af9e643.exe
"C:\Users\Admin\AppData\Local\Temp\8ae7e34678179db6c0c58fd57af9e643.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\8ae7e34678179db6c0c58fd57af9e643.exe
  C:\Users\Admin\AppData\Local\Temp\8ae7e34678179db6c0c58fd57af9e643.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8ae7e34678179db6c0c58fd57af9e643.exe

Filesize
320KB

MD5
8907cdf680aad1e482ae9fb27d81f0e8

SHA1
fd138c6a52231615e40eda55c5676810e891cf7a

SHA256
e0e2b3d22d7f1a826d21bdaaac3ba24e0af98644d64b019fb9121d91c40256c2

SHA512
e48047f84431ce908c065cfae8d7270c9319a7bde018c35305126a6887aa052dfdd40fa06c895260ff154874c4545875311146b75eb4b05378dfe390c94e50d0

Download Submit
memory/2772-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2772-1-0x0000000001AE0000-0x0000000001BA4000-memory.dmp

Filesize
784KB

Download
memory/2772-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2772-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3676-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3676-15-0x0000000001A20000-0x0000000001AE4000-memory.dmp

Filesize
784KB

Download
memory/3676-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3676-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3676-22-0x0000000005410000-0x00000000055A3000-memory.dmp

Filesize
1.6MB

Download
memory/3676-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download