xmrig | 5b8bfbec792b40bd86ad98a43f597003627fca0ab2f79029e363b41963eec3eb

Analysis

max time kernel
129s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:51

Target
2024-05-22_3f01dfa050cfde4c07ed8aab8a04cdff_cobalt-strike_cobaltstrike.exe
Size 6.0MB
Sample240522-yktnnsec2w
SHA256 5b8bfbec792b40bd86ad98a43f597003627fca0ab2f79029e363b41963eec3eb
MD5 3f01dfa050cfde4c07ed8aab8a04cdff
SHA1 71885907a69c987464e892d4206edc81488d77be
SHA512 45ed838e63d95f34fc26ce7e2d0b63fc8e55de18b1de7558a3335be09d0249f0d0abba2e91f76e04486e5befbc778be04e2d9a81d7bd852397516e16a42aa859
SSDEEP 98304:DhwvFtXdfE0pZxb56utgpPFotBER/mQ32lUY:FCl56utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4156-0-0x00007FF708650000-0x00007FF7089A4000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/4156-0-0x00007FF708650000-0x00007FF7089A4000-memory.dmp	xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4156-0-0x00007FF708650000-0x00007FF7089A4000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2024-05-22_3f01dfa050cfde4c07ed8aab8a04cdff_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3f01dfa050cfde4c07ed8aab8a04cdff_cobalt-strike_cobaltstrike.exe"
1⤵
PID:4156

memory/4156-0-0x00007FF708650000-0x00007FF7089A4000-memory.dmp

Download