xmrig | cbde4124e1d49283808319e7f2b14f5fca554a8a1942131682b308d55934c85f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:01

Target

63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe
Size

5.7MB
MD5

63e2cb83e11a59b1e70158a53cc7e912
SHA1

3c9eb3a984107d7e2d38739e90f993bbc874b28d
SHA256

cbde4124e1d49283808319e7f2b14f5fca554a8a1942131682b308d55934c85f
SHA512

d7a102b2f998d075e7a4e04a5aca71238e53aff7605ca02b42297a991ffc11d79196539a0c35287b99b5c8e2cadd992afada184a421c089a5094daf52e4ed1d9
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lU2:w+156utgpPF8u/72

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2212-0-0x000000013FE00000-0x000000014014D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe

description	pid	process	target process
PID 2212 wrote to memory of 2424	2212	63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe	WerFault.exe
PID 2212 wrote to memory of 2424	2212	63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe	WerFault.exe
PID 2212 wrote to memory of 2424	2212	63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63e2cb83e11a59b1e70158a53cc7e912_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2212 -s 72
2⤵
PID:2424

memory/2212-0-0x000000013FE00000-0x000000014014D000-memory.dmp

Filesize
3.3MB

Download