xmrig | 72bcfad8ada5a84d25b273445db94de231163580761072f4a5ca14d24fdba8ca

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6f890b5cabb0b20423fafc4d83e3a4a.exe
Size

784KB
MD5

d6f890b5cabb0b20423fafc4d83e3a4a
SHA1

f5f1aa147f3cab1f5ee973dabcf52af253f23b7a
SHA256

72bcfad8ada5a84d25b273445db94de231163580761072f4a5ca14d24fdba8ca
SHA512

d4b453584ae8aba07da7d4d474ee768bf395045d571b5705024629d99d26d0feffa699a05aea7b00b73fe0b4ed17b163daba3479de817f4eb8bb39ef4576fe47
SSDEEP

24576:bqaGzsRvlGrtyPwFhwkwmxPmy7GgkWHw5XM:bM/rqwFhwkwmxPmU7kWO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2204-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2204-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2556-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2556-23-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2556-24-0x0000000003240000-0x00000000033D3000-memory.dmp	xmrig
behavioral1/memory/2556-33-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2556-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2556	d6f890b5cabb0b20423fafc4d83e3a4a.exe

Executes dropped EXE 1 IoCs

pid	Process
2556	d6f890b5cabb0b20423fafc4d83e3a4a.exe

Loads dropped DLL 1 IoCs

pid	Process
2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000d000000012253-10.dat	upx
behavioral1/memory/2556-16-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe
2556	d6f890b5cabb0b20423fafc4d83e3a4a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2556	2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe	29
PID 2204 wrote to memory of 2556	2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe	29
PID 2204 wrote to memory of 2556	2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe	29
PID 2204 wrote to memory of 2556	2204	d6f890b5cabb0b20423fafc4d83e3a4a.exe	29

C:\Users\Admin\AppData\Local\Temp\d6f890b5cabb0b20423fafc4d83e3a4a.exe
"C:\Users\Admin\AppData\Local\Temp\d6f890b5cabb0b20423fafc4d83e3a4a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\d6f890b5cabb0b20423fafc4d83e3a4a.exe
  C:\Users\Admin\AppData\Local\Temp\d6f890b5cabb0b20423fafc4d83e3a4a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\d6f890b5cabb0b20423fafc4d83e3a4a.exe

Filesize
784KB

MD5
058f7c33dcd06b6332ff741668bcbeee

SHA1
eb98b1b15d5348e6026830848a1a05a2c5396e8e

SHA256
f0c5313d54b0f9bae41fdad3ceca8bbf06c4267127af8b45702e9e935be99980

SHA512
e55cd65cfd0778d79ded7b50da76ac448e1f22fda54a9da72e48cf4aea4cb998f411c5267cca2b66d5b51163d48d5e2b3ac76d0336b3c799a9657c9f81ce4939

Download Submit
memory/2204-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2204-2-0x0000000000310000-0x00000000003D4000-memory.dmp

Filesize
784KB

Download
memory/2204-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2204-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2556-16-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2556-17-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2556-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2556-23-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2556-24-0x0000000003240000-0x00000000033D3000-memory.dmp

Filesize
1.6MB

Download
memory/2556-33-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2556-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download