xmrig | 33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c

General

Target

33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
Size

10.4MB
MD5

dff762abefd2ac634f87aacd920c8bdc
SHA1

b8ea30c9d631fbb4a1f57c2873ca8aeb64c93643
SHA256

33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c
SHA512

54db97efb4ffcec9bc4122a6e41029c3cd457b631ede685eb883d5884f5a7b90c465dc8ec2212e712af935481073a2b4eb5180431926f03febccb055d9585341
SSDEEP

196608:D2neZjvDa5N5o9LrIbQTsbHu7THe8FhG8ryPzB3SFyFYha:D3/AU9LrIdb+THVFg8uhSYFYha

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2392-35-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-36-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-37-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-38-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-39-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-40-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-41-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-42-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-44-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-49-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-50-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-51-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-52-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-53-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-68-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2392-69-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 3 IoCs

Processes:

todymdgvwmgb.exetodymdgvwmgb.exe

pid process

468
2692 todymdgvwmgb.exe
1040 todymdgvwmgb.exe
Loads dropped DLL 1 IoCs

Processes:

pid process

468

pid	process
468
2692	todymdgvwmgb.exe
1040	todymdgvwmgb.exe

pid	process
468

Suspicious use of SetThreadContext 2 IoCs

Processes:

todymdgvwmgb.exe

description	pid	process	target process
PID 2692 set thread context of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 set thread context of 2392	2692	todymdgvwmgb.exe	svchost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2568 sc.exe
2620 sc.exe
2300 sc.exe
2632 sc.exe

pid	process
2568	sc.exe
2620	sc.exe
2300	sc.exe
2632	sc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exetodymdgvwmgb.execonhost.exetodymdgvwmgb.exe

pid	process
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2236	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2692	todymdgvwmgb.exe
2692	todymdgvwmgb.exe
2692	todymdgvwmgb.exe
2692	todymdgvwmgb.exe
2692	todymdgvwmgb.exe
2692	todymdgvwmgb.exe
2692	todymdgvwmgb.exe
2488	conhost.exe
1040	todymdgvwmgb.exe
1040	todymdgvwmgb.exe
1040	todymdgvwmgb.exe
1040	todymdgvwmgb.exe
1040	todymdgvwmgb.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468

pid	process
468

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	2856	powercfg.exe
Token: SeShutdownPrivilege	2700	powercfg.exe
Token: SeShutdownPrivilege	2500	powercfg.exe
Token: SeShutdownPrivilege	2852	powercfg.exe
Token: SeShutdownPrivilege	2412	powercfg.exe
Token: SeShutdownPrivilege	2684	powercfg.exe
Token: SeShutdownPrivilege	2408	powercfg.exe
Token: SeShutdownPrivilege	2468	powercfg.exe
Token: SeLockMemoryPrivilege	2392	svchost.exe
Token: SeShutdownPrivilege	2348	powercfg.exe
Token: SeShutdownPrivilege	2732	powercfg.exe
Token: SeShutdownPrivilege	2764	powercfg.exe
Token: SeShutdownPrivilege	320	powercfg.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

todymdgvwmgb.exe

description	pid	process	target process
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2488	2692	todymdgvwmgb.exe	conhost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe
PID 2692 wrote to memory of 2392	2692	todymdgvwmgb.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
"C:\Users\Admin\AppData\Local\Temp\33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "PHSWJLZY"
2⤵
- Launches sc.exe
PID:2300

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "PHSWJLZY" binpath= "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe" start= "auto"
2⤵
- Launches sc.exe
PID:2632

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
2⤵
- Launches sc.exe
PID:2620

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "PHSWJLZY"
2⤵
- Launches sc.exe
PID:2568

C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
"C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1040

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
Filesize
5.3MB

MD5
64a23104fa03e98c14bcb39b3876c3ed

SHA1
9470ab48cd54482012bb5df18492f0532404e0d3

SHA256
fdc9ea28abf530eaa9614a5c885e5cc17dbcab576e00ffcf9b31d488856129d5

SHA512
9694df45efa76d9fdc8e4d62a2c8acfc37a8b9b1a1217e976454c2cc2e7341dc392c32976c345a69160d2057ffd97c8d1acfb7fc7a7ce20f2776f4166d3240fd

Download Submit
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
Filesize
1.8MB

MD5
c2c1f898654e07bdbe047e97894bbf82

SHA1
67de55b824cd673f05d7d2ebbbddc38a742f5eaa

SHA256
0ea1bc511bd80c602317c1b38a1d4178795412ea6a8efa3953871394393c3b5f

SHA512
43c29f6e62fb57c7534ad5bdf7a9c168a55b053f55e2ffb9538a6d8b2b1a8e6b6480fe1ab5e81fcdc21eeef52cfdc715b696b9c4339f719f263b30409d130e19

Download Submit
C:\Windows\TEMP\ilfutfbguvtk.sys
Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
\ProgramData\jndraacsywhc\todymdgvwmgb.exe
Filesize
2.9MB

MD5
915ef63254518769ccb67b7263364bd6

SHA1
0ccf97f08caa0b6bef22165f687c34d8c0527f98

SHA256
10a8c1a6f80be08302d2b4327905144ff642175bce0915e82163c2836ff38ead

SHA512
bf0a6e9f9f39b49d15e7436a33c9901755f8e7b0fc25432f943aa2c12ef7c143e1164bd2b0797554fa123b2aaf8ed3038405c9e6e44126ab0cd319e63d65698b

Download Submit
\ProgramData\jndraacsywhc\todymdgvwmgb.exe
Filesize
5.1MB

MD5
030763cf32494bb26005ca5b51e6026d

SHA1
9b5b0144c426ad9b90844cea0a2ca067c049eaca

SHA256
6bbafb3db11743cbdfbb965dc676dd70f7dcbec8127207435ffe7dbfed7d8160

SHA512
b9d1226e218d9428d8d796e805f06153c5d6d3a46a43ef62c1122d6919a8ebb9966d73d5032359b0434e245589c226e9245338b2ff5cd898eb9c8f7aeead4b50

Download Submit
memory/1040-67-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/1040-58-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/1040-61-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/1040-63-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/1040-66-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2236-15-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2236-4-0x0000000077690000-0x0000000077692000-memory.dmp

Filesize
8KB

Download
memory/2236-2-0x0000000077690000-0x0000000077692000-memory.dmp

Filesize
8KB

Download
memory/2236-5-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2236-10-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2236-8-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2236-0-0x0000000077690000-0x0000000077692000-memory.dmp

Filesize
8KB

Download
memory/2392-52-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-41-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-34-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-35-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-36-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-37-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-38-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-39-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-40-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-53-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-42-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-44-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-71-0x0000000000C20000-0x0000000000C40000-memory.dmp

Filesize
128KB

Download
memory/2392-45-0x00000000003F0000-0x0000000000410000-memory.dmp

Filesize
128KB

Download
memory/2392-70-0x0000000000C20000-0x0000000000C40000-memory.dmp

Filesize
128KB

Download
memory/2392-69-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-49-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-50-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-51-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2392-68-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2488-30-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2488-28-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2488-27-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2488-26-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2488-29-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2488-33-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2692-24-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2692-22-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2692-17-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2692-47-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2692-46-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads