xmrig | 71e00c5a1eade66c9fd48eab9516d70b46f77b8c390af265bb66f7603cd121b5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe
Size

3.1MB
MD5

03bb334fcbb230bba9dea158f2968ae1
SHA1

ae6eb8cad29afe900828643e562dad2c2e9e55a4
SHA256

71e00c5a1eade66c9fd48eab9516d70b46f77b8c390af265bb66f7603cd121b5
SHA512

c49894fd9e78da381d3e861bcc82ae44a60f0a1c3c52e34cb293b929ec09a73ded0825e6acbdaae10c903200f72b3c05b405edb149367aeb863054b9ffdc587e
SSDEEP

98304:gTYxUL/vVGvDi/Ek27iFhQU6e0XLoZSAv0yVLg:GnXgi/Ek2WkUZZ5MyVg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/368-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/368-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2844-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2844-21-0x0000000005320000-0x00000000054B3000-memory.dmp	xmrig
behavioral2/memory/2844-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2844-30-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral2/memory/2844-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2844	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/368-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000d000000023194-11.dat	upx
behavioral2/memory/2844-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
368	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
368	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe
2844	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 2844	368	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe	88
PID 368 wrote to memory of 2844	368	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe	88
PID 368 wrote to memory of 2844	368	03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\03bb334fcbb230bba9dea158f2968ae1_JaffaCakes118.exe

Filesize
784KB

MD5
ad70816ea4c4a3af41f62148864db012

SHA1
dd6084dfc5048a67fa258904d3f771f56f15e7fb

SHA256
0423f2611a2c2f3d0c1374d5db9d7f9191253bdbf8259263bd3804d9b1284cb2

SHA512
0cd4849d484708aa7c029efd7030c03a374e05df00d625037ba1c00a9bd92f967638d1b03e520e1ab3a59b5bac93ea1ddc5ecafc1007463922284d4cd2345e45

Download Submit
memory/368-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/368-1-0x00000000019C0000-0x0000000001A84000-memory.dmp

Filesize
784KB

Download
memory/368-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/368-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2844-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2844-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2844-16-0x0000000001AB0000-0x0000000001B74000-memory.dmp

Filesize
784KB

Download
memory/2844-21-0x0000000005320000-0x00000000054B3000-memory.dmp

Filesize
1.6MB

Download
memory/2844-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2844-30-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2844-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download