xmrig | b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e | Triage

Resubmissions

26/06/2024, 00:09

240626-afk9qsvdlm 10

26/06/2024, 00:08

240626-afcmlavdkq 10

26/06/2024, 00:07

240626-aejdrasbpd 10

26/06/2024, 00:07

240626-aec7qssbnf 10

26/06/2024, 00:06

240626-ad5wcssbmg 10

26/06/2024, 00:06

240626-adxvravcml 10

26/06/2024, 00:04

240626-acvn1asaqh 10

26/06/2024, 00:04

240626-ackh2asape 10

26/06/2024, 00:03

240626-ab5sksvblp 10

Analysis

max time kernel
1779s
max time network
1816s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26/06/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mainers build.exe
Size

29.7MB
MD5

b93dd3965c81ec30c91ac4b16d56a7b5
SHA1

6061c84646ce64812a87753ecbd96681e29bfb2c
SHA256

b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
SHA512

cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
SSDEEP

786432:dQm2AnqisnglHxrW4jZ+cjyDmBOuOtkQupv6RN:eaqi0iHxq4tjysOtBr

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

resource	yara_rule
behavioral3/memory/2704-41-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-44-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-46-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-50-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-49-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-48-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-47-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-53-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-63-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-64-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral3/memory/2704-65-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
4420	services64.exe
2260	sihost64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3320 set thread context of 2704	3320	conhost.exe	82

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2756	conhost.exe
3320	conhost.exe
3320	conhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	conhost.exe
Token: SeDebugPrivilege	3320	conhost.exe
Token: SeLockMemoryPrivilege	2704	explorer.exe
Token: SeLockMemoryPrivilege	2704	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2756	4372	mainers build.exe	72
PID 4372 wrote to memory of 2756	4372	mainers build.exe	72
PID 4372 wrote to memory of 2756	4372	mainers build.exe	72
PID 2756 wrote to memory of 4300	2756	conhost.exe	74
PID 2756 wrote to memory of 4300	2756	conhost.exe	74
PID 4300 wrote to memory of 220	4300	cmd.exe	76
PID 4300 wrote to memory of 220	4300	cmd.exe	76
PID 2756 wrote to memory of 4796	2756	conhost.exe	77
PID 2756 wrote to memory of 4796	2756	conhost.exe	77
PID 4796 wrote to memory of 4420	4796	cmd.exe	79
PID 4796 wrote to memory of 4420	4796	cmd.exe	79
PID 4420 wrote to memory of 3320	4420	services64.exe	80
PID 4420 wrote to memory of 3320	4420	services64.exe	80
PID 4420 wrote to memory of 3320	4420	services64.exe	80
PID 3320 wrote to memory of 2260	3320	conhost.exe	81
PID 3320 wrote to memory of 2260	3320	conhost.exe	81
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 3320 wrote to memory of 2704	3320	conhost.exe	82
PID 2260 wrote to memory of 2028	2260	sihost64.exe	83
PID 2260 wrote to memory of 2028	2260	sihost64.exe	83
PID 2260 wrote to memory of 2028	2260	sihost64.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mainers build.exe
"C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mainers build.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:220
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      C:\Users\Admin\AppData\Roaming\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        7⤵
        
        PID:2028
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49uDLq2aoTjRxqrxdYYZG8A3ZGcLbH2E3BdwpD5UASiEhBnSZ7ERBhqJ768MaBCEGb2tQRCy4m37PEzTjW1MjNF3GEecTzC --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --tls
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
bf38f16ed068942cc8702d531b1650e5

SHA1
36c09a518beeb0db3d7e4cad6c2bbf1bc4f5ed90

SHA256
72c9c0870bfec80a95bb63038304da81999329f6343e6b8069149ca535d49e10

SHA512
1cbd6c7777301f24fd8cb2335004377370a8a24fadb0fa4bc61de814dd39a058ff2f419cefd462f30322eceb1ff17d3cd7cf1af97a8f1aaa3d00595129104368

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
523b0b07998159ef63cae05147cda63a

SHA1
382de578dbff037b4331829c9347222e409e026e

SHA256
354628b91439e1bdb39992e6c24796312da01fd833e27466f1c2270bcb3acb1e

SHA512
091126ab76a059c2d3b5084112e4c85eb8250e045b6cfee0ea8b47d01b4222a43138e003b8b9504734960f175281b138db4bb44668eae35bfa7270d417a5a7db

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
29.7MB

MD5
b93dd3965c81ec30c91ac4b16d56a7b5

SHA1
6061c84646ce64812a87753ecbd96681e29bfb2c

SHA256
b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e

SHA512
cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e

Download Submit
memory/2028-60-0x000001CD5E290000-0x000001CD5E296000-memory.dmp

Filesize
24KB

Download
memory/2028-54-0x000001CD5DF50000-0x000001CD5DF56000-memory.dmp

Filesize
24KB

Download
memory/2704-48-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-53-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-65-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-64-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-63-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-47-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-49-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-41-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-45-0x0000000000DF0000-0x0000000000E10000-memory.dmp

Filesize
128KB

Download
memory/2704-44-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-46-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2704-50-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2756-8-0x000001FAE9F00000-0x000001FAE9F12000-memory.dmp

Filesize
72KB

Download
memory/2756-0-0x000001FAE4060000-0x000001FAE5E1E000-memory.dmp

Filesize
29.7MB

Download
memory/2756-9-0x000001FAE9710000-0x000001FAE971A000-memory.dmp

Filesize
40KB

Download
memory/2756-6-0x000001FAEBEA0000-0x000001FAEDC5E000-memory.dmp

Filesize
29.7MB

Download
memory/2756-11-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-4-0x00007FFD9C953000-0x00007FFD9C954000-memory.dmp

Filesize
4KB

Download
memory/2756-10-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-18-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-13-0x00007FFD9C950000-0x00007FFD9D33C000-memory.dmp

Filesize
9.9MB

Download