Malware Analysis Report

2025-01-06 15:10

Sample ID 240525-p5x26acg3s
Target miner 2.5.rar
SHA256 5bdf60fee182e68d2b9399028c93d79dddb833e2517694f5a0f17a6207e60c14
Tags
miner xmrig
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5bdf60fee182e68d2b9399028c93d79dddb833e2517694f5a0f17a6207e60c14

Threat Level: Known bad

The file miner 2.5.rar was found to be: Known bad.

Malicious Activity Summary

miner xmrig

XMRig Miner payload

Xmrig family

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-25 12:55

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xmrig family

xmrig

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 12:55

Reported

2024-05-25 13:44

Platform

win10-20240404-en

Max time kernel

315s

Max time network

593s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 908 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe
PID 908 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp

Files

memory/4640-0-0x000001EFD7A50000-0x000001EFD7A70000-memory.dmp

memory/4640-1-0x000001EFD7AB0000-0x000001EFD7AD0000-memory.dmp

memory/4640-3-0x000001EFD7AF0000-0x000001EFD7B10000-memory.dmp

memory/4640-2-0x000001EFD7AD0000-0x000001EFD7AF0000-memory.dmp

memory/4640-4-0x000001EFD7AD0000-0x000001EFD7AF0000-memory.dmp

memory/4640-5-0x000001EFD7AF0000-0x000001EFD7B10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 12:55

Reported

2024-05-25 13:45

Platform

win10-20240404-en

Max time kernel

315s

Max time network

591s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4512 wrote to memory of 4524 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe
PID 4512 wrote to memory of 4524 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

memory/4524-0-0x000002AF0CA80000-0x000002AF0CAA0000-memory.dmp

memory/4524-1-0x000002AF0CAD0000-0x000002AF0CAF0000-memory.dmp

memory/4524-2-0x000002AF0CAF0000-0x000002AF0CB10000-memory.dmp

memory/4524-3-0x000002AF0CB10000-0x000002AF0CB30000-memory.dmp

memory/4524-4-0x000002AF0CAF0000-0x000002AF0CB10000-memory.dmp

memory/4524-5-0x000002AF0CB10000-0x000002AF0CB30000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-25 12:55

Reported

2024-05-25 13:45

Platform

win7-20240508-en

Max time kernel

361s

Max time network

593s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp

Files

memory/2648-0-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2648-2-0x00000000024C0000-0x00000000024E0000-memory.dmp

memory/2648-1-0x0000000002480000-0x00000000024A0000-memory.dmp

memory/2648-4-0x00000000024C0000-0x00000000024E0000-memory.dmp

memory/2648-3-0x0000000002480000-0x00000000024A0000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-25 12:55

Reported

2024-05-25 13:45

Platform

win10v2004-20240426-en

Max time kernel

452s

Max time network

606s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1580 wrote to memory of 3140 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe
PID 1580 wrote to memory of 3140 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

memory/3140-0-0x000001D25DC00000-0x000001D25DC20000-memory.dmp

memory/3140-1-0x00007FF837730000-0x00007FF8377DD000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-25 12:55

Reported

2024-05-25 13:46

Platform

win11-20240508-en

Max time kernel

445s

Max time network

600s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 1888 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe
PID 1856 wrote to memory of 1888 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\pool_mine_example.cmd"

C:\Users\Admin\AppData\Local\Temp\miner 2.5\xmrig-6.21.3\xmrig.exe

xmrig.exe -o xmr.2miners.com:2222 -u 435StpkeVHdcvMVhY4SQNdHusi7VaQSNkZqa1bABLLdS5wtNcPrkJNDHvquj4NXXwbJav1T7RGgybAUJvHLKWGmJAhse82k -p x

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:2222 xmr.2miners.com tcp
US 8.8.8.8:53 184.139.19.162.in-addr.arpa udp
US 52.111.227.14:443 tcp

Files

memory/1888-0-0x000001730CC10000-0x000001730CC30000-memory.dmp

memory/1888-1-0x000001730E650000-0x000001730E670000-memory.dmp

memory/1888-2-0x000001730E670000-0x000001730E690000-memory.dmp

memory/1888-3-0x000001730E690000-0x000001730E6B0000-memory.dmp

memory/1888-4-0x000001730E670000-0x000001730E690000-memory.dmp

memory/1888-5-0x000001730E690000-0x000001730E6B0000-memory.dmp