xmrig | b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e | Triage

Resubmissions

26-06-2024 00:09

240626-afk9qsvdlm 10

26-06-2024 00:08

240626-afcmlavdkq 10

26-06-2024 00:07

240626-aejdrasbpd 10

26-06-2024 00:07

240626-aec7qssbnf 10

26-06-2024 00:06

240626-ad5wcssbmg 10

26-06-2024 00:06

240626-adxvravcml 10

26-06-2024 00:04

240626-acvn1asaqh 10

26-06-2024 00:04

240626-ackh2asape 10

26-06-2024 00:03

240626-ab5sksvblp 10

Analysis

max time kernel
1780s
max time network
1801s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26-06-2024 00:07

Sharing

Report Analysis Logs

General

Target

mainers build.exe
Size

29.7MB
MD5

b93dd3965c81ec30c91ac4b16d56a7b5
SHA1

6061c84646ce64812a87753ecbd96681e29bfb2c
SHA256

b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
SHA512

cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
SSDEEP

786432:dQm2AnqisnglHxrW4jZ+cjyDmBOuOtkQupv6RN:eaqi0iHxq4tjysOtBr

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

resource	yara_rule
behavioral3/memory/696-41-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-44-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-46-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-49-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-48-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-47-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-50-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-53-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-63-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-64-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/696-65-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
3640	services64.exe
4456	sihost64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 696	5012	conhost.exe	84

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2164	conhost.exe
5012	conhost.exe
5012	conhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	conhost.exe
Token: SeDebugPrivilege	5012	conhost.exe
Token: SeLockMemoryPrivilege	696	explorer.exe
Token: SeLockMemoryPrivilege	696	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2164	4188	mainers build.exe	74
PID 4188 wrote to memory of 2164	4188	mainers build.exe	74
PID 4188 wrote to memory of 2164	4188	mainers build.exe	74
PID 2164 wrote to memory of 2432	2164	conhost.exe	76
PID 2164 wrote to memory of 2432	2164	conhost.exe	76
PID 2432 wrote to memory of 3192	2432	cmd.exe	78
PID 2432 wrote to memory of 3192	2432	cmd.exe	78
PID 2164 wrote to memory of 2292	2164	conhost.exe	79
PID 2164 wrote to memory of 2292	2164	conhost.exe	79
PID 2292 wrote to memory of 3640	2292	cmd.exe	81
PID 2292 wrote to memory of 3640	2292	cmd.exe	81
PID 3640 wrote to memory of 5012	3640	services64.exe	82
PID 3640 wrote to memory of 5012	3640	services64.exe	82
PID 3640 wrote to memory of 5012	3640	services64.exe	82
PID 5012 wrote to memory of 4456	5012	conhost.exe	83
PID 5012 wrote to memory of 4456	5012	conhost.exe	83
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 5012 wrote to memory of 696	5012	conhost.exe	84
PID 4456 wrote to memory of 2348	4456	sihost64.exe	85
PID 4456 wrote to memory of 2348	4456	sihost64.exe	85
PID 4456 wrote to memory of 2348	4456	sihost64.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mainers build.exe
"C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3192
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      C:\Users\Admin\AppData\Roaming\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5012
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        7⤵
        
        PID:2348
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49uDLq2aoTjRxqrxdYYZG8A3ZGcLbH2E3BdwpD5UASiEhBnSZ7ERBhqJ768MaBCEGb2tQRCy4m37PEzTjW1MjNF3GEecTzC --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --tls
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
bf38f16ed068942cc8702d531b1650e5

SHA1
36c09a518beeb0db3d7e4cad6c2bbf1bc4f5ed90

SHA256
72c9c0870bfec80a95bb63038304da81999329f6343e6b8069149ca535d49e10

SHA512
1cbd6c7777301f24fd8cb2335004377370a8a24fadb0fa4bc61de814dd39a058ff2f419cefd462f30322eceb1ff17d3cd7cf1af97a8f1aaa3d00595129104368

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
523b0b07998159ef63cae05147cda63a

SHA1
382de578dbff037b4331829c9347222e409e026e

SHA256
354628b91439e1bdb39992e6c24796312da01fd833e27466f1c2270bcb3acb1e

SHA512
091126ab76a059c2d3b5084112e4c85eb8250e045b6cfee0ea8b47d01b4222a43138e003b8b9504734960f175281b138db4bb44668eae35bfa7270d417a5a7db

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
29.7MB

MD5
b93dd3965c81ec30c91ac4b16d56a7b5

SHA1
6061c84646ce64812a87753ecbd96681e29bfb2c

SHA256
b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e

SHA512
cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e

Download Submit
memory/696-47-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-50-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-65-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-64-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-63-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-53-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-48-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-49-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-46-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-41-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/696-45-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/696-44-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2164-4-0x00007FFF2E023000-0x00007FFF2E024000-memory.dmp

Filesize
4KB

Download
memory/2164-6-0x00007FFF2E020000-0x00007FFF2EA0C000-memory.dmp

Filesize
9.9MB

Download
memory/2164-7-0x0000021841A00000-0x00000218437BE000-memory.dmp

Filesize
29.7MB

Download
memory/2164-0-0x0000021821BC0000-0x000002182397E000-memory.dmp

Filesize
29.7MB

Download
memory/2164-10-0x00000218273B0000-0x00000218273C2000-memory.dmp

Filesize
72KB

Download
memory/2164-18-0x00007FFF2E020000-0x00007FFF2EA0C000-memory.dmp

Filesize
9.9MB

Download
memory/2164-12-0x0000021823D00000-0x0000021823D0A000-memory.dmp

Filesize
40KB

Download
memory/2164-9-0x00007FFF2E020000-0x00007FFF2EA0C000-memory.dmp

Filesize
9.9MB

Download
memory/2164-11-0x00007FFF2E020000-0x00007FFF2EA0C000-memory.dmp

Filesize
9.9MB

Download
memory/2348-55-0x0000019D5BE30000-0x0000019D5BE36000-memory.dmp

Filesize
24KB

Download
memory/2348-60-0x0000019D5C180000-0x0000019D5C186000-memory.dmp

Filesize
24KB

Download