xmrig | 067ec1ccfdc69debdf12ad47d4775519c7e817ba7e9a535b3fe2a7d2fb1793eb

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4f794dbe63a10ece0e53ff39da77f77.exe
Size

784KB
MD5

c4f794dbe63a10ece0e53ff39da77f77
SHA1

0423270afdba6986f6d82568f50a167c712c67cf
SHA256

067ec1ccfdc69debdf12ad47d4775519c7e817ba7e9a535b3fe2a7d2fb1793eb
SHA512

7c2eaa434248c5ef3af027a68b2ae6335d758331734d0b9baf3fd7f71b020f05897f80aba4ac2ffb838b29eb4c0015fdf4c112fe7a6abb81403887d0aa9147db
SSDEEP

24576:ipzW3vuZ4lTr9bkHGyK4nsBIAx2I1TAG1dW:yk26lXZ4pnsF2IeQW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2084-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2084-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2056-19-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2056-25-0x0000000003150000-0x00000000032E3000-memory.dmp	xmrig
behavioral1/memory/2056-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2056-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2056	c4f794dbe63a10ece0e53ff39da77f77.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	c4f794dbe63a10ece0e53ff39da77f77.exe

Loads dropped DLL 1 IoCs

pid	Process
2084	c4f794dbe63a10ece0e53ff39da77f77.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x0009000000012256-10.dat	upx
behavioral1/memory/2084-15-0x0000000003240000-0x0000000003552000-memory.dmp	upx
behavioral1/memory/2056-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2084	c4f794dbe63a10ece0e53ff39da77f77.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2084	c4f794dbe63a10ece0e53ff39da77f77.exe
2056	c4f794dbe63a10ece0e53ff39da77f77.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2056	2084	c4f794dbe63a10ece0e53ff39da77f77.exe	29
PID 2084 wrote to memory of 2056	2084	c4f794dbe63a10ece0e53ff39da77f77.exe	29
PID 2084 wrote to memory of 2056	2084	c4f794dbe63a10ece0e53ff39da77f77.exe	29
PID 2084 wrote to memory of 2056	2084	c4f794dbe63a10ece0e53ff39da77f77.exe	29

C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe
"C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe
  C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe

Filesize
784KB

MD5
18eefd844350d083eb6ccfef2f300977

SHA1
8cd4393824a8e3f92ea042bab7d68cbb0ccf46f1

SHA256
5763863039d8aaba6c0fe389eb7d4151534e4eaa2b09630be2b0893e245debc3

SHA512
0e811f424f5b7cef0ca051eabeb9e3d22f5a77ce81269698b87aae9d4deba84e4c8e4c6f4ad3b4676c65c0f450be9cec38d366a2d3d6ff5cd85bb5eb4fd0d436

Download Submit
memory/2056-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2056-18-0x0000000000330000-0x00000000003F4000-memory.dmp

Filesize
784KB

Download
memory/2056-19-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2056-25-0x0000000003150000-0x00000000032E3000-memory.dmp

Filesize
1.6MB

Download
memory/2056-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2056-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2084-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2084-1-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2084-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2084-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2084-15-0x0000000003240000-0x0000000003552000-memory.dmp

Filesize
3.1MB

Download