xmrig | e60cedf3509684fa676ae97f1bb5dc89788e50f3290398b259cc3ce5ba336f64

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
Size 3.0MB
Sample240614-bcpcnaydpe
SHA256 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
MD5 02aa02aee2a6bd93a4a8f4941a0e6310
SHA1 03287a15bfd67ff8c3340c0bae425ecaa37a929f
SHA512 8103b18a8957fb1cb1e0f6f00eb4c81a037151fc2cd89f13f530eb7ea3002d23cdad037fb39610c38c3a71029a6c7b767d7ce00ada4cbd37e9f6ba0ed9af0f0c
SSDEEP 49152:YKbiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyago:YKGWJ6sDYI2qPX4fgPZcUAUjSkXvDUin
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner

Malware Config

Signatures

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002340a-20.dat	family_xmrig
behavioral2/files/0x000700000002340a-20.dat	xmrig
behavioral2/memory/456-23-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-24-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-25-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-26-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-27-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-28-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-29-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-30-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-31-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-32-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-33-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-34-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-35-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig
behavioral2/memory/456-36-0x00007FF68F640000-0x00007FF690143000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2820	netsh.exe

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4724	attrib.exe
4492	attrib.exe
3588	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

Executes dropped EXE 3 IoCs

pid	Process
4568	svchost.exe
1668	svchost.exe
456	systems.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug\c3p\svchost.exe	attrib.exe
File created	C:\WINDOWS\Debug\c3p\config.json	systems.exe
File opened for modification	C:\Windows\debug\c3p	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\config.json	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\SHA256SUMS	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\svchost.exe	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File opened for modification	C:\Windows\debug\c3p\systems.exe	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\__tmp_rar_sfx_access_check_240602625	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File opened for modification	C:\Windows\debug\c3p\svchost.exe	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\systems.exe	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\WinRing0x64.sys	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File opened for modification	C:\Windows\debug\c3p\WinRing0x64.sys	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File opened for modification	C:\Windows\debug\c3p	attrib.exe
File opened for modification	C:\Windows\debug\c3p\config.json	attrib.exe
File opened for modification	C:\Windows\debug\c3p\systems.exe	attrib.exe
File opened for modification	C:\Windows\debug\c3p\cmd.bat	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File opened for modification	C:\Windows\debug\c3p\config.json	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File opened for modification	C:\Windows\debug\c3p\SHA256SUMS	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
File created	C:\Windows\debug\c3p\cmd.bat	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2668	sc.exe
856	sc.exe
4856	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	456	systems.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
456	systems.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4420	4932	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe	84
PID 4932 wrote to memory of 4420	4932	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe	84
PID 4932 wrote to memory of 4420	4932	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe	84
PID 4420 wrote to memory of 4568	4420	cmd.exe	87
PID 4420 wrote to memory of 4568	4420	cmd.exe	87
PID 4420 wrote to memory of 4568	4420	cmd.exe	87
PID 4420 wrote to memory of 2668	4420	cmd.exe	88
PID 4420 wrote to memory of 2668	4420	cmd.exe	88
PID 4420 wrote to memory of 2668	4420	cmd.exe	88
PID 4420 wrote to memory of 856	4420	cmd.exe	90
PID 4420 wrote to memory of 856	4420	cmd.exe	90
PID 4420 wrote to memory of 856	4420	cmd.exe	90
PID 4420 wrote to memory of 4856	4420	cmd.exe	91
PID 4420 wrote to memory of 4856	4420	cmd.exe	91
PID 4420 wrote to memory of 4856	4420	cmd.exe	91
PID 4420 wrote to memory of 4724	4420	cmd.exe	93
PID 4420 wrote to memory of 4724	4420	cmd.exe	93
PID 4420 wrote to memory of 4724	4420	cmd.exe	93
PID 4420 wrote to memory of 4492	4420	cmd.exe	94
PID 4420 wrote to memory of 4492	4420	cmd.exe	94
PID 4420 wrote to memory of 4492	4420	cmd.exe	94
PID 4420 wrote to memory of 3588	4420	cmd.exe	95
PID 4420 wrote to memory of 3588	4420	cmd.exe	95
PID 4420 wrote to memory of 3588	4420	cmd.exe	95
PID 4420 wrote to memory of 2820	4420	cmd.exe	96
PID 4420 wrote to memory of 2820	4420	cmd.exe	96
PID 4420 wrote to memory of 2820	4420	cmd.exe	96
PID 1668 wrote to memory of 456	1668	svchost.exe	98
PID 1668 wrote to memory of 456	1668	svchost.exe	98

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4724	attrib.exe
4492	attrib.exe
3588	attrib.exe

C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
"C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\c3p\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\WINDOWS\Debug\c3p\svchost.exe
    C:\WINDOWS\Debug\c3p\svchost.exe install "Networks2" C:\WINDOWS\Debug\c3p\systems.exe
    3⤵
    - Executes dropped EXE
    PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc config "Networks2" DisplayName= "Networksrs2"
    3⤵
    - Launches sc.exe
    PID:2668
- - C:\Windows\SysWOW64\sc.exe
    sc description "Networks2" "Microsoft Windows Networks"
    3⤵
    - Launches sc.exe
    PID:856
- - C:\Windows\SysWOW64\sc.exe
    sc start "Networks2"
    3⤵
    - Launches sc.exe
    PID:4856
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\c3p +h +a
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4724
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\c3p\*.json +h +a +s +r
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4492
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\c3p\*.exe +h +a +s +r
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3588
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:2820

C:\WINDOWS\Debug\c3p\svchost.exe
C:\WINDOWS\Debug\c3p\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668
- C:\WINDOWS\Debug\c3p\systems.exe
  "C:\WINDOWS\Debug\c3p\systems.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.bat

Path C:\Windows\debug\c3p\cmd.bat
Size 478B
SHA256 da2faa5eb4171dd5272402dab13e882445a9e8f114defea3caabd2ad841e24f4
MD5 6585c3073cfc45a3bdd30ed7521e84a0
SHA1 5196abc0728f1a14e554faf155fc3b31c1f57257
SHA512 fa11518e7e258d2a980d07f3e9c03eb1bf9b6a7413f62e2da3977046ad5fcb2bb05bd55ed83512a3027d9d07b5a884f0bccd16742f9c9fd6891ace98f80dd849
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Windows\debug\c3p\config.json
Size 2KB
SHA256 ee17b3a37459ed492847d2dc003f4904dcbf0d1579416474ac8c7b07ca96b81c
MD5 ba73071a3d8a7fe866d174aa256d1c3e
SHA1 0a38fd8a8b287d44b4964e862ab241872e036115
SHA512 ccc9b11406e893cdc6f2563e0c7e00a488d1685e2d58e6324b2680faffa40cb47cf9a8eab4cd77b1c67a85aa9ffd4811a21f84954f0f7345a0a477082106348d
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Windows\debug\c3p\svchost.exe
Size 288KB
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
SSDEEP 6144:4BULviqYnI3QA7JTXRnZSHL2GZbkG/TZgLgst2rDkXNBD:wqBlG/TZgUsxXNBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

systems.exe

Path C:\Windows\debug\c3p\systems.exe
Size 7.9MB
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
SSDEEP 98304:/Ss0YJodntQk3Hv7I4a1Shua+XOoca2q4RVHNaAXMbmx4WH5umbLtb/IRHOhrgjY:LqQk3DBNfrkhKj4DbrxLskS3qAP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-26-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-29-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-24-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-25-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-22-0x000001E1C2D60000-0x000001E1C2D80000-memory.dmp

Download

memory/456-27-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-28-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-23-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-30-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-31-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-32-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-33-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-34-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-35-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

memory/456-36-0x00007FF68F640000-0x00007FF690143000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads