xmrig | 74bc37f92cf8999a15ecfb560576e8aad2145323d0eb727698ac36def6c8cbfd

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4cb5eb98270ef6b44936a978e37e0a1.exe
Size

784KB
MD5

b4cb5eb98270ef6b44936a978e37e0a1
SHA1

a45e48e40869a5d915eef165329f7edc69ff051a
SHA256

74bc37f92cf8999a15ecfb560576e8aad2145323d0eb727698ac36def6c8cbfd
SHA512

53e0ba311341e364567fe21fb44c771a8a66cbfa74842d006346ba8ac0a98add8bdeff9d7dc5a74abc8183431a35d5ebc8fd4f55e690c2e1ddf0622c26d37c58
SSDEEP

24576:K5YI4AMCufb1c/je077iWrzji5UmzCMhOnlS:YYI4hjWLe077iWrK5ulS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2632-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2508-19-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2508-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2508-26-0x00000000030D0000-0x0000000003263000-memory.dmp	xmrig
behavioral1/memory/2508-34-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2508-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2508	b4cb5eb98270ef6b44936a978e37e0a1.exe

Executes dropped EXE 1 IoCs

pid	Process
2508	b4cb5eb98270ef6b44936a978e37e0a1.exe

Loads dropped DLL 1 IoCs

pid	Process
2632	b4cb5eb98270ef6b44936a978e37e0a1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2632-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000a000000012254-10.dat	upx
behavioral1/memory/2632-15-0x00000000031B0000-0x00000000034C2000-memory.dmp	upx
behavioral1/memory/2508-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2632	b4cb5eb98270ef6b44936a978e37e0a1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2632	b4cb5eb98270ef6b44936a978e37e0a1.exe
2508	b4cb5eb98270ef6b44936a978e37e0a1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2508	2632	b4cb5eb98270ef6b44936a978e37e0a1.exe	29
PID 2632 wrote to memory of 2508	2632	b4cb5eb98270ef6b44936a978e37e0a1.exe	29
PID 2632 wrote to memory of 2508	2632	b4cb5eb98270ef6b44936a978e37e0a1.exe	29
PID 2632 wrote to memory of 2508	2632	b4cb5eb98270ef6b44936a978e37e0a1.exe	29

C:\Users\Admin\AppData\Local\Temp\b4cb5eb98270ef6b44936a978e37e0a1.exe
"C:\Users\Admin\AppData\Local\Temp\b4cb5eb98270ef6b44936a978e37e0a1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\b4cb5eb98270ef6b44936a978e37e0a1.exe
  C:\Users\Admin\AppData\Local\Temp\b4cb5eb98270ef6b44936a978e37e0a1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\b4cb5eb98270ef6b44936a978e37e0a1.exe

Filesize
784KB

MD5
a9137607b2ec5355b0e44cca6b2e7d34

SHA1
dcb915c66d9b02bb5c4b97cdae4b72d8556bfbd8

SHA256
20228581597483eead95cb8c677f16d6c54faa4cfddebe9f127e69894c4023c2

SHA512
cd072a2e5499be46a68dd014f2e97ed456079d56bcac02e2d30c730e9ef9fa1250df9adaefa9d84e509dde8a56f501622a3cc125327402e7fd24ea3dead1fef7

Download Submit
memory/2508-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2508-18-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2508-19-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2508-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2508-26-0x00000000030D0000-0x0000000003263000-memory.dmp

Filesize
1.6MB

Download
memory/2508-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2508-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2632-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2632-2-0x00000000018B0000-0x0000000001974000-memory.dmp

Filesize
784KB

Download
memory/2632-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2632-15-0x00000000031B0000-0x00000000034C2000-memory.dmp

Filesize
3.1MB

Download
memory/2632-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download