xmrig | 877d6e27c1c7d6bf28ae440eb87656f3f0ff96215cf0c152eda47927fafed9e6

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c595728fc636bc9d562cdc875a73935c.exe
Size

784KB
MD5

c595728fc636bc9d562cdc875a73935c
SHA1

2eff242dc08d9cd546435a2a6f6387132442542e
SHA256

877d6e27c1c7d6bf28ae440eb87656f3f0ff96215cf0c152eda47927fafed9e6
SHA512

b25946721f6358075c4267c57aefd509b07f1a80c5d3366038477ab3cb0adbe17497faf17fd33dcb18261ff68cf304d2572ee561e8de97fd34c907e89a95de0e
SSDEEP

12288:FZOC/QBxMRm+Zel45esUOgSx1lDzw7x1UgLrZoMv239UIEbyQpOuyQCdX:FZOCo0m+MOX1zw7HfWMu2hyQizd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2992-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2992-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2524-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2524-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2524-25-0x0000000003150000-0x00000000032E3000-memory.dmp	xmrig
behavioral1/memory/2524-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2524	c595728fc636bc9d562cdc875a73935c.exe

Executes dropped EXE 1 IoCs

pid	Process
2524	c595728fc636bc9d562cdc875a73935c.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	c595728fc636bc9d562cdc875a73935c.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000a00000001222a-10.dat	upx
behavioral1/memory/2992-15-0x0000000003150000-0x0000000003462000-memory.dmp	upx
behavioral1/memory/2524-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2992	c595728fc636bc9d562cdc875a73935c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2992	c595728fc636bc9d562cdc875a73935c.exe
2524	c595728fc636bc9d562cdc875a73935c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2524	2992	c595728fc636bc9d562cdc875a73935c.exe	29
PID 2992 wrote to memory of 2524	2992	c595728fc636bc9d562cdc875a73935c.exe	29
PID 2992 wrote to memory of 2524	2992	c595728fc636bc9d562cdc875a73935c.exe	29
PID 2992 wrote to memory of 2524	2992	c595728fc636bc9d562cdc875a73935c.exe	29

C:\Users\Admin\AppData\Local\Temp\c595728fc636bc9d562cdc875a73935c.exe
"C:\Users\Admin\AppData\Local\Temp\c595728fc636bc9d562cdc875a73935c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\c595728fc636bc9d562cdc875a73935c.exe
  C:\Users\Admin\AppData\Local\Temp\c595728fc636bc9d562cdc875a73935c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\c595728fc636bc9d562cdc875a73935c.exe

Filesize
784KB

MD5
4c8ab547127fecc4fea51f1730fc757d

SHA1
0a3301424473ad6738d528e78947d22465a816a1

SHA256
11583d4c34f4e02c5e130df3a59f2ddf8271c991eef37ea766c1c88d77d3238b

SHA512
9d642b96805ae3112b98fc5986537269bf7fe3a2784f44a184f1e42f08cdc13a0fc79d80d4ff9331ba767c914eb92980454efb33d4488636e50c9c47a0e7204f

Download Submit
memory/2524-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2524-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2524-19-0x0000000000310000-0x00000000003D4000-memory.dmp

Filesize
784KB

Download
memory/2524-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2524-25-0x0000000003150000-0x00000000032E3000-memory.dmp

Filesize
1.6MB

Download
memory/2524-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2992-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2992-2-0x00000000002A0000-0x0000000000364000-memory.dmp

Filesize
784KB

Download
memory/2992-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2992-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2992-15-0x0000000003150000-0x0000000003462000-memory.dmp

Filesize
3.1MB

Download