xmrig | ba196731789fb54618e7f7e1a10938f8b0db88907409c404d4fec560d1984937

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:24

Target

2024-05-22_255d38650bbd5574bfe00951818acee4_cobalt-strike_cobaltstrike.exe
Size

6.0MB
MD5

255d38650bbd5574bfe00951818acee4
SHA1

5b1022f4d445c3230d80e66d3929ab689521df9d
SHA256

ba196731789fb54618e7f7e1a10938f8b0db88907409c404d4fec560d1984937
SHA512

ede79c9cab2fbd9333784d07ad205c2f050b9498dcb0e7eea7b4afd4a1b684cf70a9554873f5d721d695ee3e38b81a02181bdca91802bc46ea29edd67971f0b1
SSDEEP

98304:DhwvFtXdfE0pZxb56utgpPFotBER/mQ32lUS:FCl56utgpPF8u/7S

Score

10^/10

xmrig miner upx

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1284-0-0x00007FF7D27C0000-0x00007FF7D2B14000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1284-0-0x00007FF7D27C0000-0x00007FF7D2B14000-memory.dmp	xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1284-0-0x00007FF7D27C0000-0x00007FF7D2B14000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2024-05-22_255d38650bbd5574bfe00951818acee4_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_255d38650bbd5574bfe00951818acee4_cobalt-strike_cobaltstrike.exe"
1⤵
PID:1284

memory/1284-0-0x00007FF7D27C0000-0x00007FF7D2B14000-memory.dmp

Filesize
3.3MB

Download