xmrig | fd02b8ef9d3731f6a232f4cf9cb0b565401ec78c98609cd5ac4b3c0bf4c03233

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe
Size

784KB
MD5

fb28c4964898fc81293c406dcfaee173
SHA1

14148503af05a6e641988f27d187aa33a6c76551
SHA256

fd02b8ef9d3731f6a232f4cf9cb0b565401ec78c98609cd5ac4b3c0bf4c03233
SHA512

eb329e3efffd9eee6ce567290744941db87a5c524cb7043f77709908a76bd05e73efd46693e2c451179900cc4612d1868d71b3f7f3958e8f0de03e4209304b93
SSDEEP

24576:Zr/BytCV/7cihSnnBMGe3CxBVTaZf/x7agOtpwT:Zr/BQk42CnB3xvTapnOtpwT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2264-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2264-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2600-19-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2600-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2600-25-0x0000000003280000-0x0000000003413000-memory.dmp	xmrig
behavioral1/memory/2600-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2600	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2600	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x00090000000122bf-10.dat	upx
behavioral1/memory/2264-15-0x0000000003270000-0x0000000003582000-memory.dmp	upx
behavioral1/memory/2600-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe
2600	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2600	2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2600	2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2600	2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2600	2264	fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fb28c4964898fc81293c406dcfaee173_JaffaCakes118.exe

Filesize
784KB

MD5
4e856788d8638836f65153b9cf061476

SHA1
29ca17be5595f2a7fd80e079f9b135980948f642

SHA256
8dae16d75bf0a3e63ae8280871dd4569b9b555ab7f4a158b768079628c7e5586

SHA512
d52a820e1c71f5d78d02629594f4bfc3e08ffcb05100b4887a9ff16ff4ee24948c7a22c31502a6680386a6fe12d3642ec0b8f35af974487eeae1c191865d160a

Download Submit
memory/2264-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2264-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2264-3-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2264-15-0x0000000003270000-0x0000000003582000-memory.dmp

Filesize
3.1MB

Download
memory/2264-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2600-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2600-18-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2600-19-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2600-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2600-25-0x0000000003280000-0x0000000003413000-memory.dmp

Filesize
1.6MB

Download
memory/2600-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download