xmrig | e6e91d467b069fc8f3a8a429f5a614692282b2707109d808b05eee37158fb52d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4bada9429472ca6f5fe9053c4589b1d.exe
Size

784KB
MD5

d4bada9429472ca6f5fe9053c4589b1d
SHA1

7ae2183394a6c42abe0cf7dcd299640e6333070b
SHA256

e6e91d467b069fc8f3a8a429f5a614692282b2707109d808b05eee37158fb52d
SHA512

ada5bd64db07ca5be9e9b7b2305ae47b61a81a0c28033a29b2fe9fb7ccc132820f704647632e5001023605eb4cc8eabb31c3ec50f3b26c136dea52cf1a181f43
SSDEEP

24576:rmNJca/1XplAiGSx2j59RQLyKodWpLYkUSOqf:S71Xpl4fj5gLue8kUSv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2892-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2892-15-0x0000000003120000-0x0000000003432000-memory.dmp	xmrig
behavioral1/memory/2892-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2496-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2496-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2496-27-0x0000000003150000-0x00000000032E3000-memory.dmp	xmrig
behavioral1/memory/2496-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2892-35-0x0000000003120000-0x0000000003432000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2496	d4bada9429472ca6f5fe9053c4589b1d.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	d4bada9429472ca6f5fe9053c4589b1d.exe

Loads dropped DLL 1 IoCs

pid	Process
2892	d4bada9429472ca6f5fe9053c4589b1d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2892-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x00070000000122be-12.dat	upx
behavioral1/memory/2496-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2892	d4bada9429472ca6f5fe9053c4589b1d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2892	d4bada9429472ca6f5fe9053c4589b1d.exe
2496	d4bada9429472ca6f5fe9053c4589b1d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2496	2892	d4bada9429472ca6f5fe9053c4589b1d.exe	29
PID 2892 wrote to memory of 2496	2892	d4bada9429472ca6f5fe9053c4589b1d.exe	29
PID 2892 wrote to memory of 2496	2892	d4bada9429472ca6f5fe9053c4589b1d.exe	29
PID 2892 wrote to memory of 2496	2892	d4bada9429472ca6f5fe9053c4589b1d.exe	29

C:\Users\Admin\AppData\Local\Temp\d4bada9429472ca6f5fe9053c4589b1d.exe
"C:\Users\Admin\AppData\Local\Temp\d4bada9429472ca6f5fe9053c4589b1d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\d4bada9429472ca6f5fe9053c4589b1d.exe
  C:\Users\Admin\AppData\Local\Temp\d4bada9429472ca6f5fe9053c4589b1d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d4bada9429472ca6f5fe9053c4589b1d.exe

Filesize
784KB

MD5
878cb25797f34652d976f2d462443d83

SHA1
7d957f350ca6d7bf8d4ccf5ae7a1dfd78c5fea04

SHA256
71fc2157409910318aae48abc440aa67cde1e14daa7be7fa4eb5f9406369a0c4

SHA512
fd96aa03838889edaafb9698fe80332e990ed228229f3c30a5384dda070f76b625e8afb02bc43c32b98b6cddcfd0672bfa91dea9bbcf26bee7f8df101346b616

Download Submit
memory/2496-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2496-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2496-19-0x00000000002A0000-0x0000000000364000-memory.dmp

Filesize
784KB

Download
memory/2496-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2496-27-0x0000000003150000-0x00000000032E3000-memory.dmp

Filesize
1.6MB

Download
memory/2496-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2892-3-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2892-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2892-15-0x0000000003120000-0x0000000003432000-memory.dmp

Filesize
3.1MB

Download
memory/2892-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2892-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2892-35-0x0000000003120000-0x0000000003432000-memory.dmp

Filesize
3.1MB

Download