xmrig | b9422d53d99a46c7c62ca0c620a989fad8b5459b7828f6cb6f2f5476a8652051

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2024 03:48

Target

2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe
Size

6.0MB
MD5

ccc76ba43bddb09074eacf2a02637523
SHA1

c3c54e72795b43105ff739967c41fa7218446f2c
SHA256

b9422d53d99a46c7c62ca0c620a989fad8b5459b7828f6cb6f2f5476a8652051
SHA512

6adb099ca1cb2c6bf8396dfca1d5a1297dbaf7c466b8cc08f909c6b6268214a78c4a8ce643de9ab9f87d9cfc44d42c019a1bc2365a4f7726697e16e8e4995772
SSDEEP

98304:EniLf9FdfE0pZB156utgpPFotBER/mQ32lUN:eOl56utgpPF8u/7N

Score

10^/10

xmrig miner upx

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF7194E0000-0x00007FF719834000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF7194E0000-0x00007FF719834000-memory.dmp	xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF7194E0000-0x00007FF719834000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe"
1⤵
PID:4256

memory/4256-0-0x00007FF7194E0000-0x00007FF719834000-memory.dmp

Filesize
3.3MB

Download