xmrig | 33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c

Analysis

max time kernel
302s
max time network
304s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
Size

10.4MB
MD5

dff762abefd2ac634f87aacd920c8bdc
SHA1

b8ea30c9d631fbb4a1f57c2873ca8aeb64c93643
SHA256

33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c
SHA512

54db97efb4ffcec9bc4122a6e41029c3cd457b631ede685eb883d5884f5a7b90c465dc8ec2212e712af935481073a2b4eb5180431926f03febccb055d9585341
SSDEEP

196608:D2neZjvDa5N5o9LrIbQTsbHu7THe8FhG8ryPzB3SFyFYha:D3/AU9LrIdb+THVFg8uhSYFYha

Score

10^/10

xmrig evasion miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2964-34-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-35-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-36-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-37-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-38-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-39-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-40-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-41-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-43-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-48-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-49-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-50-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-52-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-51-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-66-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2964-68-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 3 IoCs

Processes:

todymdgvwmgb.exetodymdgvwmgb.exe

pid process

464
2428 todymdgvwmgb.exe
2244 todymdgvwmgb.exe
Loads dropped DLL 1 IoCs

Processes:

pid process

464

pid	process
464
2428	todymdgvwmgb.exe
2244	todymdgvwmgb.exe

pid	process
464

Suspicious use of SetThreadContext 2 IoCs

Processes:

todymdgvwmgb.exe

description	pid	process	target process
PID 2428 set thread context of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 set thread context of 2964	2428	todymdgvwmgb.exe	svchost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

2580 sc.exe
2588 sc.exe
2784 sc.exe
2668 sc.exe

pid	process
2580	sc.exe
2588	sc.exe
2784	sc.exe
2668	sc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exetodymdgvwmgb.execonhost.exetodymdgvwmgb.exe

pid	process
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2772	33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
2428	todymdgvwmgb.exe
2428	todymdgvwmgb.exe
2428	todymdgvwmgb.exe
2428	todymdgvwmgb.exe
2428	todymdgvwmgb.exe
2428	todymdgvwmgb.exe
2428	todymdgvwmgb.exe
584	conhost.exe
2244	todymdgvwmgb.exe
2244	todymdgvwmgb.exe
2244	todymdgvwmgb.exe
2244	todymdgvwmgb.exe
2244	todymdgvwmgb.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	2676	powercfg.exe
Token: SeShutdownPrivilege	2572	powercfg.exe
Token: SeShutdownPrivilege	2520	powercfg.exe
Token: SeShutdownPrivilege	2644	powercfg.exe
Token: SeShutdownPrivilege	2396	powercfg.exe
Token: SeShutdownPrivilege	2868	powercfg.exe
Token: SeShutdownPrivilege	576	powercfg.exe
Token: SeShutdownPrivilege	1932	powercfg.exe
Token: SeLockMemoryPrivilege	2964	svchost.exe
Token: SeShutdownPrivilege	1232	powercfg.exe
Token: SeShutdownPrivilege	1644	powercfg.exe
Token: SeShutdownPrivilege	1304	powercfg.exe
Token: SeShutdownPrivilege	1692	powercfg.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

todymdgvwmgb.exe

description	pid	process	target process
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 584	2428	todymdgvwmgb.exe	conhost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe
PID 2428 wrote to memory of 2964	2428	todymdgvwmgb.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe
"C:\Users\Admin\AppData\Local\Temp\33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "PHSWJLZY"
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "PHSWJLZY" binpath= "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:2668
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:2580
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "PHSWJLZY"
  2⤵
  - Launches sc.exe
  PID:2588

C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1644
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1304
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1232
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1692
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe

Filesize
1.4MB

MD5
639a9f193248259cd562c0d106806f13

SHA1
805124f795eb1e39cadcc6696882ade23fd30374

SHA256
9ebe68b8c51c926c6ddad259401f176fc680cb19bd75b702c6447d0d22b172cf

SHA512
87ff9c78c436d2b155985757da9b549cc4f1ffd94e510aaecbeea224eb26b8204b2538b6716c002812ea79ad1e7daad44738145c106c49427660ec2a963631d4

Download Submit
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe

Filesize
1.2MB

MD5
6788880c4272e78f72b79308c1bcf630

SHA1
1ecd20f634496cd05d6e643b5ba313dacba11bfd

SHA256
0761e72303ec9756572e6185dff02bdfec555445bc0d3ac62b08ab108161cd2e

SHA512
e0e5324733deecc182a7037f8c8358a653085b502176c741b0e1d0bd788c541ed37b3d4c8c0678392001ea6fd254523d1cd6e33b6c9837cb07fb4f291d12843e

Download Submit
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe

Filesize
1.8MB

MD5
c2c1f898654e07bdbe047e97894bbf82

SHA1
67de55b824cd673f05d7d2ebbbddc38a742f5eaa

SHA256
0ea1bc511bd80c602317c1b38a1d4178795412ea6a8efa3953871394393c3b5f

SHA512
43c29f6e62fb57c7534ad5bdf7a9c168a55b053f55e2ffb9538a6d8b2b1a8e6b6480fe1ab5e81fcdc21eeef52cfdc715b696b9c4339f719f263b30409d130e19

Download Submit
C:\Windows\TEMP\ilfutfbguvtk.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
\ProgramData\jndraacsywhc\todymdgvwmgb.exe

Filesize
2.0MB

MD5
1ae428bee44939bbd1807ceefd1ec93b

SHA1
c6504fee64d35a5a84c2ceae6da3e40a8c551f5e

SHA256
0fa3e8f5380942f90baed165fccd8149bba2101738e25e11a1d12bdb62611ddb

SHA512
c12e2f3d9902b1e25b5e01d94009eb75a7dfec688ea0c710e541ba35559e7672e1f917293b1df21262b1c2bae3a1cb382e640a29b78d492a713e1fb91058c6d4

Download Submit
\ProgramData\jndraacsywhc\todymdgvwmgb.exe

Filesize
2.2MB

MD5
219b52ac3a72481b804770ff7b9f7e06

SHA1
1a57b3aa4c91c4a58aa1e07a31b1a11668f8a215

SHA256
119990a602031f2a3ffd82a90cc0d18d3342d749a88b242156cfb2bcdad1d852

SHA512
210e2f9183ab8fb44df869c925c900304a44684213eb3b90bdc230ac8c9cf2f3520cd161a5ebe82c1c8faeb7cda37dee4c0848a877c4474170cc8843f7230594

Download Submit
memory/584-26-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/584-25-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/584-31-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/584-29-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/584-28-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/584-27-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2244-61-0x0000000077780000-0x0000000077929000-memory.dmp

Filesize
1.7MB

Download
memory/2244-65-0x0000000077780000-0x0000000077929000-memory.dmp

Filesize
1.7MB

Download
memory/2244-56-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2244-67-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2244-60-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2428-45-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2428-20-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2428-22-0x0000000077780000-0x0000000077929000-memory.dmp

Filesize
1.7MB

Download
memory/2428-47-0x0000000077780000-0x0000000077929000-memory.dmp

Filesize
1.7MB

Download
memory/2772-15-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2772-10-0x0000000077780000-0x0000000077929000-memory.dmp

Filesize
1.7MB

Download
memory/2772-5-0x0000000140000000-0x000000014199B000-memory.dmp

Filesize
25.6MB

Download
memory/2772-0-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/2772-8-0x0000000077780000-0x0000000077929000-memory.dmp

Filesize
1.7MB

Download
memory/2772-2-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/2772-4-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/2964-38-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-44-0x0000000000140000-0x0000000000160000-memory.dmp

Filesize
128KB

Download
memory/2964-43-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-41-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-40-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-48-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-49-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-50-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-52-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-51-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-39-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-37-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-36-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-35-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-34-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-66-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-33-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-68-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2964-69-0x0000000000BB0000-0x0000000000BD0000-memory.dmp

Filesize
128KB

Download
memory/2964-70-0x0000000000BB0000-0x0000000000BD0000-memory.dmp

Filesize
128KB

Download