xmrig | 6401d53fdddb6194e884e7079f9b69059bd1fb4fe78b5d3b30029571adf4a893

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acd53ede7fa369984fa54f897bb754d2.exe
Size

784KB
MD5

acd53ede7fa369984fa54f897bb754d2
SHA1

dd36a9bba8bf39b8bdf90d92a1d2fb746341a685
SHA256

6401d53fdddb6194e884e7079f9b69059bd1fb4fe78b5d3b30029571adf4a893
SHA512

fe354700b4ee6028c76bc6eeb178280ed503c934f66cf22d2b1552aa1e2db60941cd69b150f250b8efd12cd4f35b359c0efe453508cc5c9e135efc65251aae0d
SSDEEP

12288:m26yxIDBq9bVwZe1iTegx7DyFe6EsfiXB5yuSeUPTU0C58mOdkdk6Lw+j5lhYtk:sDBq9qLTegNk5U/R+QD5BPdA+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2856-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2856-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2156-19-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2156-25-0x0000000003220000-0x00000000033B3000-memory.dmp	xmrig
behavioral1/memory/2156-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2156-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2156	acd53ede7fa369984fa54f897bb754d2.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	acd53ede7fa369984fa54f897bb754d2.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	acd53ede7fa369984fa54f897bb754d2.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000b000000013442-10.dat	upx
behavioral1/memory/2856-14-0x0000000003140000-0x0000000003452000-memory.dmp	upx
behavioral1/files/0x000b000000013442-16.dat	upx
behavioral1/memory/2156-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2856	acd53ede7fa369984fa54f897bb754d2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2856	acd53ede7fa369984fa54f897bb754d2.exe
2156	acd53ede7fa369984fa54f897bb754d2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2156	2856	acd53ede7fa369984fa54f897bb754d2.exe	29
PID 2856 wrote to memory of 2156	2856	acd53ede7fa369984fa54f897bb754d2.exe	29
PID 2856 wrote to memory of 2156	2856	acd53ede7fa369984fa54f897bb754d2.exe	29
PID 2856 wrote to memory of 2156	2856	acd53ede7fa369984fa54f897bb754d2.exe	29

C:\Users\Admin\AppData\Local\Temp\acd53ede7fa369984fa54f897bb754d2.exe
"C:\Users\Admin\AppData\Local\Temp\acd53ede7fa369984fa54f897bb754d2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\acd53ede7fa369984fa54f897bb754d2.exe
  C:\Users\Admin\AppData\Local\Temp\acd53ede7fa369984fa54f897bb754d2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\acd53ede7fa369984fa54f897bb754d2.exe

Filesize
784KB

MD5
24928a92139fc3739865eba2b78423a2

SHA1
3791cf113b1e7df2a8ee29463d36eb8e8423f30e

SHA256
446f47a2ca0017ef7086610db36a6057b919eebf94ad0d9f969693f8c81e77eb

SHA512
3964cfad6c3b5921054731c832b94656f5e457fe71abdf4baeddbbfe8d73e9b028d7010b1506f00af8c2471460a899a73e2aa51221bf3ca30570a043164e6f0d

Download Submit
\Users\Admin\AppData\Local\Temp\acd53ede7fa369984fa54f897bb754d2.exe

Filesize
256KB

MD5
77f188a2880f0dd98fb7c16bc457c4f8

SHA1
993c4802d758fc1e8326389cbc8c652248d525a3

SHA256
0cc5f6b5562f2e3994d674c7097f2bd66304283b672cb1b334ea85269a28e0ae

SHA512
d46f5b1392d4cb1284a61ae2e204a6b4c4fc47b6204aea247aa2fa1df341618c0f8c84e46a5f7991438a3e7c19e640d447dd8761527c9555f2daac8d0c0f7163

Download Submit
memory/2156-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2156-18-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2156-19-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2156-25-0x0000000003220000-0x00000000033B3000-memory.dmp

Filesize
1.6MB

Download
memory/2156-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2156-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2856-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2856-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2856-14-0x0000000003140000-0x0000000003452000-memory.dmp

Filesize
3.1MB

Download
memory/2856-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2856-2-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download