xmrig | f3e8d52f091aa3063961acc27fb8c088297773685fd8a5e97c6ed34bc65ebc4d

General

Target

23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe
Size

2.1MB
MD5

23a097ca0bcf6b79c870413268609957
SHA1

aa2467ab52e4c5126a49ffb17f35e2146a176244
SHA256

f3e8d52f091aa3063961acc27fb8c088297773685fd8a5e97c6ed34bc65ebc4d
SHA512

79c75c6e69172b66b7fae373912371f103adfb5ad6166ceea8786aaf3a84ca19f655043ef01166bf29b3eaad86d3eaa5ba16967ad95064d5c1b5217be4e95af4
SSDEEP

49152:sX26gwxUCqE5ewGTpvctnZIOUdd8S7HUQoZun/WvOFcvx3CgMD1an5:36gwxUC/QwGTpIIOUdP70VsnuvOFySgn

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2644-13-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-8-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-11-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-16-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-14-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-12-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-19-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-15-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-10-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-9-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-22-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-24-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-27-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-29-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-28-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-26-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-25-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig
behavioral1/memory/2644-30-0x0000000140000000-0x000000014072E000-memory.dmp	xmrig

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2644	explorer.exe
Token: SeLockMemoryPrivilege	2644	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29
PID 1968 wrote to memory of 2644	1968	23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23a097ca0bcf6b79c870413268609957_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr.pool.minergate.com:45700 [email protected] --pass= --cpu-max-threads-hint=50 --donate-level=5 --no-cpu
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-20-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-1-0x000000013F340000-0x000000013F558000-memory.dmp

Filesize
2.1MB

Download
memory/1968-3-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-4-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/1968-0-0x000007FEF6133000-0x000007FEF6134000-memory.dmp

Filesize
4KB

Download
memory/2644-19-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-10-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-8-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-11-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-17-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

Filesize
4KB

Download
memory/2644-16-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-14-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-12-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-13-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-5-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-15-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-7-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-9-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-6-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-22-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-23-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/2644-24-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-27-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-29-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-28-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-26-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-25-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download
memory/2644-30-0x0000000140000000-0x000000014072E000-memory.dmp

Filesize
7.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads