xmrig | 06f96ae510b1d24d379ef38713cde9b636783c7ac2b57e8bc15230cd3d490c7b

Analysis

max time kernel
1481s
max time network
1845s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.ps1
Size 340B
Sample240611-bf3pfsxgrg
SHA256 06f96ae510b1d24d379ef38713cde9b636783c7ac2b57e8bc15230cd3d490c7b
MD5 c33f92da4d6e3228e3557bfda749c4eb
SHA1 9316488c1f5961d5b02a14e2a94a0811bc0eb449
SHA512 704774acccb782092d79dd8dbf03735344261317df032eea76bf47b23c340b681f6364174a3243937b695e8db336cd89d647a77f6ad7f975821451f84ffa8d16
MD5 SHA1 SHA512

Score

10^/10

xmrig execution miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023437-40.dat	family_xmrig
behavioral2/files/0x0007000000023437-40.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2928	powershell.exe
11	2928	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
60	xmrig.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2928	powershell.exe
2928	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeLockMemoryPrivilege	60	xmrig.exe
Token: SeLockMemoryPrivilege	60	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
60	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 60	2928	powershell.exe	86
PID 2928 wrote to memory of 60	2928	powershell.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\xmrig\xmrig-6.21.3\xmrig.exe
  "C:\Users\Admin\AppData\Local\Temp\xmrig\xmrig-6.21.3\xmrig.exe" -a gr -o stratum+ssl://ghostrider.unmineable.com:443 -u SHIB:0x780ee8ef96b65121ad30144a70fb487bcdf80630.unmineable_worker_gmvatcyb -p x --cpu-priority 4
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_b2xrgxbt.rvr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b2xrgxbt.rvr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

xmrig.exe

Path C:\Users\Admin\AppData\Local\Temp\xmrig\xmrig-6.21.3\xmrig.exe
Size 6.1MB
SHA256 e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
MD5 c0f8959614ae06561216158d78a787e5
SHA1 73167d1fd0cee1c96a6505606d21cbfe4369eb00
SHA512 a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746
SSDEEP 98304:AwHlVzThdquIJ3mH6KfTSr2tJCkN3dOauqMAC2Taf43TZquOE2:fVz5CkN3dXuq9Taf4jLt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-43-0x000001E97FB90000-0x000001E97FBB0000-memory.dmp

Download

memory/2928-0-0x00007FFAF4F43000-0x00007FFAF4F45000-memory.dmp

Download

memory/2928-3-0x0000023FFFFC0000-0x0000023FFFFE2000-memory.dmp

Download

memory/2928-11-0x00007FFAF4F40000-0x00007FFAF5A01000-memory.dmp

Download

memory/2928-12-0x00007FFAF4F40000-0x00007FFAF5A01000-memory.dmp

Download

memory/2928-14-0x00007FFAF4F40000-0x00007FFAF5A01000-memory.dmp

Download

memory/2928-15-0x0000023FFFF90000-0x0000023FFFFA2000-memory.dmp

Download

memory/2928-16-0x0000023FFFF30000-0x0000023FFFF3A000-memory.dmp

Download

memory/2928-44-0x00007FFAF4F40000-0x00007FFAF5A01000-memory.dmp

Download

memory/2928-45-0x00007FFAF4F43000-0x00007FFAF4F45000-memory.dmp

Download