Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 15:13
Behavioral task
behavioral1
Sample
xmrig-6.21.1/WinRing0x64.sys
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
xmrig-6.21.1/WinRing0x64.sys
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
xmrig-6.21.1/start.cmd
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
xmrig-6.21.1/start.cmd
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
xmrig-6.21.1/xmrig.exe
Resource
win7-20240221-en
General
-
Target
xmrig-6.21.1/start.cmd
-
Size
172B
-
MD5
5ceb4ce3e065fbf229f1cf8f1c4479e6
-
SHA1
f1b9ae7e6fdc78620951a0c24f0c37ace9d073b9
-
SHA256
ba0e79502ee78b1187e55bf4ad19be80fa971db90a7f218d504d23cec7166342
-
SHA512
ae2bdc313c5d07a572efdf61d3b2c15d452a4fe73ea78fd3a2e824b6d9ae939e576791228a2d891abe48396cb67f1002eb79ca6c4870f80cd95862ccaeb7b726
Malware Config
Signatures
-
XMRig Miner payload 14 IoCs
Processes:
resource yara_rule behavioral3/memory/3052-3-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-4-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-5-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-8-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-9-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-10-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-11-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-12-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-13-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-14-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-15-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-16-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-17-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig behavioral3/memory/3052-18-0x000000013F7E0000-0x00000001402E4000-memory.dmp xmrig -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
xmrig.exedescription pid process Token: SeLockMemoryPrivilege 3052 xmrig.exe Token: SeLockMemoryPrivilege 3052 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 3052 xmrig.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2904 wrote to memory of 3052 2904 cmd.exe xmrig.exe PID 2904 wrote to memory of 3052 2904 cmd.exe xmrig.exe PID 2904 wrote to memory of 3052 2904 cmd.exe xmrig.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.1\start.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.1\xmrig.exexmrig.exe -o gulf.moneroocean.stream:80 -u 46pyUVGiWpzLqjMsdWqFk7WEW4CcEukj9dyMXLN5KYExVNPMbDNpHc1bE7xpWcnQSjFFQYVZTXr7rNiNNrDCE5qYHTcqpcZ -a rx/0 -k2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3052-0-0x0000000000080000-0x00000000000A0000-memory.dmpFilesize
128KB
-
memory/3052-1-0x0000000001DF0000-0x0000000001E10000-memory.dmpFilesize
128KB
-
memory/3052-2-0x0000000001E10000-0x0000000001E30000-memory.dmpFilesize
128KB
-
memory/3052-3-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-4-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-6-0x0000000001DF0000-0x0000000001E10000-memory.dmpFilesize
128KB
-
memory/3052-5-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-7-0x0000000001E10000-0x0000000001E30000-memory.dmpFilesize
128KB
-
memory/3052-8-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-9-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-10-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-11-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-12-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-13-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-14-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-15-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-16-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-17-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB
-
memory/3052-18-0x000000013F7E0000-0x00000001402E4000-memory.dmpFilesize
11.0MB