xmrig | f20db6281d6f6c5f377e7c04cd13439466b1677528e112b929ee6f4a442353e7

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9847f148c0dda34b59d419df8231a00.exe
Size

784KB
MD5

b9847f148c0dda34b59d419df8231a00
SHA1

ef28813c7f6ff503b03c7d79c37498e354006512
SHA256

f20db6281d6f6c5f377e7c04cd13439466b1677528e112b929ee6f4a442353e7
SHA512

2d98f112fd1638d70d0d78db41dd1797d0b7e756bb50bbc08ac45d9611c5fdb75604e04935c33aa126fafec4681fe71a85c6f58290be7539f4c1fc85c5679e4e
SSDEEP

24576:Zan4gx3ONvGeCyAvkHLW6fcVjxcJMFrQOcEU+:ZbOmZQWMFgl+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2616-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2616-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1124-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1124-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1124-22-0x0000000005480000-0x0000000005613000-memory.dmp	xmrig
behavioral2/memory/1124-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1124	b9847f148c0dda34b59d419df8231a00.exe

Executes dropped EXE 1 IoCs

pid	Process
1124	b9847f148c0dda34b59d419df8231a00.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2616-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000900000002321f-11.dat	upx
behavioral2/memory/1124-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2616	b9847f148c0dda34b59d419df8231a00.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2616	b9847f148c0dda34b59d419df8231a00.exe
1124	b9847f148c0dda34b59d419df8231a00.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1124	2616	b9847f148c0dda34b59d419df8231a00.exe	89
PID 2616 wrote to memory of 1124	2616	b9847f148c0dda34b59d419df8231a00.exe	89
PID 2616 wrote to memory of 1124	2616	b9847f148c0dda34b59d419df8231a00.exe	89

C:\Users\Admin\AppData\Local\Temp\b9847f148c0dda34b59d419df8231a00.exe
"C:\Users\Admin\AppData\Local\Temp\b9847f148c0dda34b59d419df8231a00.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\b9847f148c0dda34b59d419df8231a00.exe
  C:\Users\Admin\AppData\Local\Temp\b9847f148c0dda34b59d419df8231a00.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b9847f148c0dda34b59d419df8231a00.exe

Filesize
93KB

MD5
9c05fcef18dda7b9192947b62d2f076a

SHA1
7adaf92f327b6d1f7538c678c978a9e2b0f45466

SHA256
f0ee3887c3fb5f069990d5e02ff9318414f80f8cf79eaab107174e4064c5989b

SHA512
e2a34f79965084bf52967c1e93e6310a46bbec7598fe137ed9e58c09dbcc02127a6fe4dd49e4de920dcd4fa70601054da1e03d4120e957b52985547086d67675

Download Submit
memory/1124-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1124-15-0x0000000001A90000-0x0000000001B54000-memory.dmp

Filesize
784KB

Download
memory/1124-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1124-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1124-22-0x0000000005480000-0x0000000005613000-memory.dmp

Filesize
1.6MB

Download
memory/1124-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2616-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2616-1-0x0000000001900000-0x00000000019C4000-memory.dmp

Filesize
784KB

Download
memory/2616-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2616-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download