xmrig | e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
Size 3.0MB
Sample240613-ch22dathlq
SHA256 e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
MD5 b3c4004238ef139fe90b5f8041ada1cd
SHA1 26f8b075c7df48eeec5d9aec593410ba87ffd559
SHA512 621af77406736a99ab4ab03b6b94404caca80bbc1efd4fa54b78e75486a72ef0882f6418df85e0b07afc49eb6b405952e99a938359afe785028f7deb4cc121a0
SSDEEP 49152:YKFiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyago:YKYWJ6sDYI2qPX4fgPZcUAUjSkXvDUin
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner

Malware Config

Signatures

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023414-20.dat	family_xmrig
behavioral2/files/0x0007000000023414-20.dat	xmrig
behavioral2/memory/3932-23-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-24-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-25-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-26-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-27-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-28-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-29-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-30-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-31-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-32-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-33-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-34-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-35-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig
behavioral2/memory/3932-36-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2228	netsh.exe

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1968	attrib.exe
2588	attrib.exe
512	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe

Executes dropped EXE 3 IoCs

pid	Process
1136	svchost.exe
1448	svchost.exe
3932	systems.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug\has\cmd.bat	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\config.json	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\WinRing0x64.sys	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\svchost.exe	attrib.exe
File created	C:\WINDOWS\Debug\has\config.json	systems.exe
File opened for modification	C:\Windows\debug\has	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File created	C:\Windows\debug\has\__tmp_rar_sfx_access_check_240608890	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\systems.exe	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File created	C:\Windows\debug\has\WinRing0x64.sys	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\config.json	attrib.exe
File created	C:\Windows\debug\has\cmd.bat	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\svchost.exe	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File created	C:\Windows\debug\has\systems.exe	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has	attrib.exe
File created	C:\Windows\debug\has\config.json	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File created	C:\Windows\debug\has\SHA256SUMS	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\SHA256SUMS	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File created	C:\Windows\debug\has\svchost.exe	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
File opened for modification	C:\Windows\debug\has\systems.exe	attrib.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
408	sc.exe
1804	sc.exe
1900	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3932	systems.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3932	systems.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3728	4516	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe	84
PID 4516 wrote to memory of 3728	4516	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe	84
PID 4516 wrote to memory of 3728	4516	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe	84
PID 3728 wrote to memory of 1136	3728	cmd.exe	88
PID 3728 wrote to memory of 1136	3728	cmd.exe	88
PID 3728 wrote to memory of 1136	3728	cmd.exe	88
PID 3728 wrote to memory of 408	3728	cmd.exe	89
PID 3728 wrote to memory of 408	3728	cmd.exe	89
PID 3728 wrote to memory of 408	3728	cmd.exe	89
PID 3728 wrote to memory of 1804	3728	cmd.exe	90
PID 3728 wrote to memory of 1804	3728	cmd.exe	90
PID 3728 wrote to memory of 1804	3728	cmd.exe	90
PID 3728 wrote to memory of 1900	3728	cmd.exe	91
PID 3728 wrote to memory of 1900	3728	cmd.exe	91
PID 3728 wrote to memory of 1900	3728	cmd.exe	91
PID 3728 wrote to memory of 1968	3728	cmd.exe	93
PID 3728 wrote to memory of 1968	3728	cmd.exe	93
PID 3728 wrote to memory of 1968	3728	cmd.exe	93
PID 3728 wrote to memory of 2588	3728	cmd.exe	94
PID 3728 wrote to memory of 2588	3728	cmd.exe	94
PID 3728 wrote to memory of 2588	3728	cmd.exe	94
PID 3728 wrote to memory of 512	3728	cmd.exe	95
PID 3728 wrote to memory of 512	3728	cmd.exe	95
PID 3728 wrote to memory of 512	3728	cmd.exe	95
PID 3728 wrote to memory of 2228	3728	cmd.exe	96
PID 3728 wrote to memory of 2228	3728	cmd.exe	96
PID 3728 wrote to memory of 2228	3728	cmd.exe	96
PID 1448 wrote to memory of 3932	1448	svchost.exe	98
PID 1448 wrote to memory of 3932	1448	svchost.exe	98

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1968	attrib.exe
2588	attrib.exe
512	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe
"C:\Users\Admin\AppData\Local\Temp\e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\has\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\WINDOWS\Debug\has\svchost.exe
    C:\WINDOWS\Debug\has\svchost.exe install "Networks3" C:\WINDOWS\Debug\has\systems.exe
    3⤵
    - Executes dropped EXE
    PID:1136
- - C:\Windows\SysWOW64\sc.exe
    sc config "Networks3" DisplayName= "Networksrs3"
    3⤵
    - Launches sc.exe
    PID:408
- - C:\Windows\SysWOW64\sc.exe
    sc description "Networks3" "Microsoft Windows Networks"
    3⤵
    - Launches sc.exe
    PID:1804
- - C:\Windows\SysWOW64\sc.exe
    sc start "Networks3"
    3⤵
    - Launches sc.exe
    PID:1900
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\has +h +a
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1968
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\has\*.json +h +a +s +r
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2588
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\has\*.exe +h +a +s +r
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:512
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:2228

C:\WINDOWS\Debug\has\svchost.exe
C:\WINDOWS\Debug\has\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448
- C:\WINDOWS\Debug\has\systems.exe
  "C:\WINDOWS\Debug\has\systems.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.bat

Path C:\Windows\debug\has\cmd.bat
Size 478B
SHA256 7f2ef225ef392e0f597fb1bbfce04e363327248a502b35290ab4d1901d57a45e
MD5 60801f362ceca1de2e470b85e07e4a9b
SHA1 1f293608464c3efd96b1ef2f027c60f4cc3a79fe
SHA512 37f8cc3732c1442dce7e9085c82756542c93c5698fb6638229c929192df5c33f0903ff96f962d33b96d770f9df73c7371a6b44317a57482882228d979763a0d0
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Windows\debug\has\config.json
Size 2KB
SHA256 bb60c444f8cf1a6ef02d9512b6ea02c85a101696597f26c223372dd8e2f0bf1e
MD5 17ed2f8fbaaad7e8361af2c9779aefee
SHA1 6e7651a0fa3e7594b5a802d4b6d1c7faf18fb160
SHA512 5d76675cdea5962292ecb13ca0b3f8b79d7973c61974c98260b2944fc1c804a356b4d592416b670fa0e7cf48d4288f7e0043c79d9e4fcd7d37a91c519c05d665
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Windows\debug\has\svchost.exe
Size 288KB
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
SSDEEP 6144:4BULviqYnI3QA7JTXRnZSHL2GZbkG/TZgLgst2rDkXNBD:wqBlG/TZgUsxXNBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

systems.exe

Path C:\Windows\debug\has\systems.exe
Size 7.9MB
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
SSDEEP 98304:/Ss0YJodntQk3Hv7I4a1Shua+XOoca2q4RVHNaAXMbmx4WH5umbLtb/IRHOhrgjY:LqQk3DBNfrkhKj4DbrxLskS3qAP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3932-26-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-29-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-24-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-25-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-22-0x000001EF45E50000-0x000001EF45E70000-memory.dmp

Download

memory/3932-27-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-28-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-23-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-30-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-31-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-32-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-33-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-34-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-35-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

memory/3932-36-0x00007FF66AF90000-0x00007FF66BA93000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads