xmrig | 55818ef859190746b3f8bcd16abb787b2aa7478d3cbb26bc323a284dca5d925c

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac3ab813f034022384909c4a83ddf11c.exe
Size

784KB
MD5

ac3ab813f034022384909c4a83ddf11c
SHA1

873bb8be328c6d4b17c70f7ec3032f965aa210cb
SHA256

55818ef859190746b3f8bcd16abb787b2aa7478d3cbb26bc323a284dca5d925c
SHA512

72684e88110ff69a744a7433ba3489a77a499829387466819c1f4c12ac7644054092a2739be181360acd821e98f981d956dc8820464bb72ffcbfc887cc5f82ea
SSDEEP

24576:CuWzb76RujsWAK8J5/kjrt9PXJo9X1RbZoB:C1zOuNAKA58jzJYX1R

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2512-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2512-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2212-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2212-23-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2212-26-0x0000000003250000-0x00000000033E3000-memory.dmp	xmrig
behavioral1/memory/2212-33-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2212-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2212	ac3ab813f034022384909c4a83ddf11c.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	ac3ab813f034022384909c4a83ddf11c.exe

Loads dropped DLL 1 IoCs

pid	Process
2512	ac3ab813f034022384909c4a83ddf11c.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000b000000012256-10.dat	upx
behavioral1/memory/2212-16-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2512	ac3ab813f034022384909c4a83ddf11c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2512	ac3ab813f034022384909c4a83ddf11c.exe
2212	ac3ab813f034022384909c4a83ddf11c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2212	2512	ac3ab813f034022384909c4a83ddf11c.exe	29
PID 2512 wrote to memory of 2212	2512	ac3ab813f034022384909c4a83ddf11c.exe	29
PID 2512 wrote to memory of 2212	2512	ac3ab813f034022384909c4a83ddf11c.exe	29
PID 2512 wrote to memory of 2212	2512	ac3ab813f034022384909c4a83ddf11c.exe	29

C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe
"C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe
  C:\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ac3ab813f034022384909c4a83ddf11c.exe

Filesize
784KB

MD5
13f1c89c03ab032e37ba7b40da21e2f2

SHA1
de729e34bd7a7f49dcb7b7a789f242bf934c36f9

SHA256
de7a2c21eef38343ff10c205c65a373a67dd1535b10818cc5b6490f03958f5cd

SHA512
d4c6794d59e1441122c3c334a638703a07c5774cef3bc911717c82b3b212b6e570e412a9b23cc4252ecca6931d0e30b2a457df29f22a1e15463f023c2f34c57c

Download Submit
memory/2212-16-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2212-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2212-18-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2212-23-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2212-26-0x0000000003250000-0x00000000033E3000-memory.dmp

Filesize
1.6MB

Download
memory/2212-33-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2212-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2512-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2512-2-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2512-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2512-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download