xmrig | 067ec1ccfdc69debdf12ad47d4775519c7e817ba7e9a535b3fe2a7d2fb1793eb

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4f794dbe63a10ece0e53ff39da77f77.exe
Size

784KB
MD5

c4f794dbe63a10ece0e53ff39da77f77
SHA1

0423270afdba6986f6d82568f50a167c712c67cf
SHA256

067ec1ccfdc69debdf12ad47d4775519c7e817ba7e9a535b3fe2a7d2fb1793eb
SHA512

7c2eaa434248c5ef3af027a68b2ae6335d758331734d0b9baf3fd7f71b020f05897f80aba4ac2ffb838b29eb4c0015fdf4c112fe7a6abb81403887d0aa9147db
SSDEEP

24576:ipzW3vuZ4lTr9bkHGyK4nsBIAx2I1TAG1dW:yk26lXZ4pnsF2IeQW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3112-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3112-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2024-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2024-20-0x0000000005400000-0x0000000005593000-memory.dmp	xmrig
behavioral2/memory/2024-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2024-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2024	c4f794dbe63a10ece0e53ff39da77f77.exe

Executes dropped EXE 1 IoCs

pid	Process
2024	c4f794dbe63a10ece0e53ff39da77f77.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3112-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000800000002320a-11.dat	upx
behavioral2/memory/2024-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3112	c4f794dbe63a10ece0e53ff39da77f77.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3112	c4f794dbe63a10ece0e53ff39da77f77.exe
2024	c4f794dbe63a10ece0e53ff39da77f77.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2024	3112	c4f794dbe63a10ece0e53ff39da77f77.exe	88
PID 3112 wrote to memory of 2024	3112	c4f794dbe63a10ece0e53ff39da77f77.exe	88
PID 3112 wrote to memory of 2024	3112	c4f794dbe63a10ece0e53ff39da77f77.exe	88

C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe
"C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe
  C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c4f794dbe63a10ece0e53ff39da77f77.exe

Filesize
784KB

MD5
522358aec88161b7062c8d6ccb0a0e86

SHA1
fd1e49bffcfa7622da2b171aa6d9879bf4e95227

SHA256
e64176ae5215586223f598eccf62cc355196cf5e120b2d0a9eb06a08d2b4d23a

SHA512
b451ff8e052315d3dcb3351614c5f1723cbfc78f716a563816b276c175b6610e00013b9d9e9f0e592be6c7b3530a1c9cb90f5a9065833f3e36d03c81a9d4455e

Download Submit
memory/2024-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2024-15-0x0000000001A10000-0x0000000001AD4000-memory.dmp

Filesize
784KB

Download
memory/2024-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2024-20-0x0000000005400000-0x0000000005593000-memory.dmp

Filesize
1.6MB

Download
memory/2024-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2024-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3112-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3112-1-0x0000000001B00000-0x0000000001BC4000-memory.dmp

Filesize
784KB

Download
memory/3112-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3112-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download