xmrig | 12d2f681c6950ee43a28ddced3741761f0fcf85827c3a52c2701bd9ce0bd5ed1

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c2f2a802bdb164a5af227b7549ec806.exe
Size

784KB
MD5

9c2f2a802bdb164a5af227b7549ec806
SHA1

0b008ff1a18f954568da59b16497d87428b62c54
SHA256

12d2f681c6950ee43a28ddced3741761f0fcf85827c3a52c2701bd9ce0bd5ed1
SHA512

f304f3acb4e110121965b18e26896823f2f0113f1317775867c511b755704d005863724aa915e1ae6f53c1c8b0cbd36e587f865e235029dfed1dbad0f41e66a7
SSDEEP

24576:KR/l8p/TiOJwpykYvbfpEF00w856j9p1Bl:KR/lW/3JwEkIbREF00d6j9p1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3648-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3648-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3600-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3600-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3600-21-0x00000000053E0000-0x0000000005573000-memory.dmp	xmrig
behavioral2/memory/3600-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3600	9c2f2a802bdb164a5af227b7549ec806.exe

Executes dropped EXE 1 IoCs

pid	Process
3600	9c2f2a802bdb164a5af227b7549ec806.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3648-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00070000000231fc-11.dat	upx
behavioral2/memory/3600-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3648	9c2f2a802bdb164a5af227b7549ec806.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3648	9c2f2a802bdb164a5af227b7549ec806.exe
3600	9c2f2a802bdb164a5af227b7549ec806.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3600	3648	9c2f2a802bdb164a5af227b7549ec806.exe	86
PID 3648 wrote to memory of 3600	3648	9c2f2a802bdb164a5af227b7549ec806.exe	86
PID 3648 wrote to memory of 3600	3648	9c2f2a802bdb164a5af227b7549ec806.exe	86

C:\Users\Admin\AppData\Local\Temp\9c2f2a802bdb164a5af227b7549ec806.exe
"C:\Users\Admin\AppData\Local\Temp\9c2f2a802bdb164a5af227b7549ec806.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\9c2f2a802bdb164a5af227b7549ec806.exe
  C:\Users\Admin\AppData\Local\Temp\9c2f2a802bdb164a5af227b7549ec806.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9c2f2a802bdb164a5af227b7549ec806.exe

Filesize
784KB

MD5
9c98fd30e88eac9a916b69f073409d5a

SHA1
76f409522bdb64df3083b27329f3e5057a6c419c

SHA256
364911b5c84056b7282f7666a1b2d9a5f77bb92a68100cbfd349c7f1c41ed16f

SHA512
56c64ef5f3afa20e3b9d2c67304df9925fdcab2e1de7f9be86c559649f19a1c8102826b0a382fa79c1f0b1a236fa5446c90f1a77e6d2a659d4727a12d9f5aedf

Download Submit
memory/3600-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3600-14-0x00000000019F0000-0x0000000001AB4000-memory.dmp

Filesize
784KB

Download
memory/3600-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3600-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3600-21-0x00000000053E0000-0x0000000005573000-memory.dmp

Filesize
1.6MB

Download
memory/3600-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3648-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3648-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/3648-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3648-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download