xmrig | 50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

6.4MB
MD5

2eafb4926d78feb0b61d5b995d0fe6ee
SHA1

f6e75678f1dafcb18408452ea948b9ad51b5d83e
SHA256

50b50beee2174d403ddba91f4f0b13d8e754ed2f979ad7c60baeb6617249bb30
SHA512

1885f5874c44a6841be4d53140ad63304e8d1924bb98fe14602d884fbc289ec8913db772a9e2db93e45298d1328700e2000ddab109af3964eaf6f23af61ef78e
SSDEEP

196608:1pznZ/ySos+NnrlQ5jrNoIgDJ0I6x/oAP:1pDZk9LQ5vNdeJ0IC

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2252-15-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-16-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-17-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-18-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-19-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-20-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-21-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-22-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-25-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-30-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-32-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-33-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-34-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-35-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral2/memory/2252-36-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

tmp.exeiojmibhyhiws.exeiojmibhyhiws.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iojmibhyhiws.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iojmibhyhiws.exe

Executes dropped EXE 2 IoCs

Processes:

iojmibhyhiws.exeiojmibhyhiws.exe

pid	Process
4932	iojmibhyhiws.exe
4936	iojmibhyhiws.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

iojmibhyhiws.exe

description	pid	Process	procid_target
PID 4932 set thread context of 4140	4932	iojmibhyhiws.exe	96
PID 4932 set thread context of 2252	4932	iojmibhyhiws.exe	97

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
1788	sc.exe
1272	sc.exe
2728	sc.exe
832	sc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

tmp.exeiojmibhyhiws.execonhost.execonhost.exe

pid	Process
4176	tmp.exe
4176	tmp.exe
4176	tmp.exe
4176	tmp.exe
4176	tmp.exe
4932	iojmibhyhiws.exe
4932	iojmibhyhiws.exe
4140	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe
2252	conhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

conhost.exe

description	pid	Process
Token: SeLockMemoryPrivilege	2252	conhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

cmd.exeiojmibhyhiws.exe

description	pid	Process	procid_target
PID 3500 wrote to memory of 1316	3500	cmd.exe	95
PID 3500 wrote to memory of 1316	3500	cmd.exe	95
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 4140	4932	iojmibhyhiws.exe	96
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97
PID 4932 wrote to memory of 2252	4932	iojmibhyhiws.exe	97

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4176
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:1788
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:1272
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1316
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "FLWCUERA"
  2⤵
  - Launches sc.exe
  PID:832

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- - C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
    "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    PID:4936
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
3.1MB

MD5
c842153e64025142874636bd79c5910b

SHA1
c1472df9eb67f684c69d274cac23f8dcc30ec6f3

SHA256
28a825a6e89e802f7598523bb9b394533747e0512e8f3a40273390240435ff88

SHA512
91b7ae0d1a31dbf3b9ce04eea37f1dd72f676c5e054635236556d6a702326b7bd7d9c0681248e5712ea6c8dd5ac53d611f0eaa23d669c8b918cca38237bc4222

Download Submit
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
2.6MB

MD5
2d6353701901bf6b40d5ac7481b1309c

SHA1
f4b3a4c19d807f86d3f3f622751086b6f5f135aa

SHA256
ba57bbc1a180b78ffa08c7c8253e161024f9b918c7f64501bdf9f6bc6537a8df

SHA512
a65897eacae4bc50e1f0166c73768a5a088f30d02b9bd8b11316dbf48d4be582d54ec7daa900e7c9ca3ebf34bbac6b841676e62d5822ef8d66bb4d84d2eaa72b

Download Submit
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe

Filesize
3.1MB

MD5
82c3e17ad267e14f48163b7c57a86daa

SHA1
b198bc39fdcaea2ba8e1ea2b6e46dac5f67402e0

SHA256
e87a6ceb59583bad098e7252740b79a784e33f46bc7c415296f73344e02c556f

SHA512
cf2b4984efeb16a678d8f35993731f61991236f5815df7356b42b4199aeb243fcf2b708df1c4f8368b74211d8420f2a046a1bca317fe74d25141ea790cf4a219

Download Submit
C:\Windows\TEMP\zamrbllfjgdb.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
memory/2252-30-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-20-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-36-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-35-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-34-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-33-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-32-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-14-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-15-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-16-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-17-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-18-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-19-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-26-0x0000020F3DB30000-0x0000020F3DB50000-memory.dmp

Filesize
128KB

Download
memory/2252-21-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-22-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2252-25-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/4140-7-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4140-6-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4140-10-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4140-12-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4140-8-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4140-9-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4176-0-0x00007FF69D100000-0x00007FF69DB3D000-memory.dmp

Filesize
10.2MB

Download
memory/4176-2-0x00007FF69D100000-0x00007FF69DB3D000-memory.dmp

Filesize
10.2MB

Download
memory/4932-24-0x00007FF721770000-0x00007FF7221AD000-memory.dmp

Filesize
10.2MB

Download
memory/4932-5-0x00007FF721770000-0x00007FF7221AD000-memory.dmp

Filesize
10.2MB

Download
memory/4936-31-0x00007FF721770000-0x00007FF7221AD000-memory.dmp

Filesize
10.2MB

Download