xmrig | ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa

General

Target

ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe
Size

2.5MB
MD5

8eee0f0bcbb9d63691ac5cda65dfc44c
SHA1

4951089c091c3f76a34b7c1ca7f2ef11d9c7a272
SHA256

ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa
SHA512

a8b55bb906db48d4a1c8f48ea0fa10a7ca6023df7e1d27929455860d34c60de1ef92bed17950bb312d5be0e67435242672d4279fb89cf40de227d83c6414092f
SSDEEP

49152:4EZK0WjkVdtNqSx4jRSkzAc0Fw1kRTuiG49TwzXK2EEokwuPuw0V8/AzWuO:429m+PEShkzF0WkRCirNSa2Bokwu9Az

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/1944-10-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1944-1-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-4-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-5-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-6-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-9-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-11-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-12-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-13-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-10-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-7-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-3-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-2-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-15-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1944-14-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 1944	2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1944	explorer.exe
Token: SeLockMemoryPrivilege	1944	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1944	2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe	28
PID 2284 wrote to memory of 1944	2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe	28
PID 2284 wrote to memory of 1944	2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe	28
PID 2284 wrote to memory of 1944	2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe	28
PID 2284 wrote to memory of 1944	2284	ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe	28

C:\Users\Admin\AppData\Local\Temp\ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe
"C:\Users\Admin\AppData\Local\Temp\ca7889d0eef0b84b31b707105c710e793aa02f3a1ca8d48294f8a488ef2526fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-1-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-4-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-5-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-6-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-8-0x0000000000050000-0x0000000000070000-memory.dmp

Filesize
128KB

Download
memory/1944-9-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-11-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-12-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-13-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-10-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-7-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-3-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-2-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-15-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-16-0x00000000023E0000-0x0000000002400000-memory.dmp

Filesize
128KB

Download
memory/1944-17-0x0000000002400000-0x0000000002420000-memory.dmp

Filesize
128KB

Download
memory/1944-14-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1944-18-0x00000000023E0000-0x0000000002400000-memory.dmp

Filesize
128KB

Download
memory/1944-19-0x0000000002400000-0x0000000002420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing