xmrig | 3a25af3b277fe9fcb13e72347ce57e1f4f0673e531fcf2ef35d98f1367a06f09

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe
Size

784KB
MD5

3c90d12d57bd7a1ebc9141e7956486f8
SHA1

d1a326eed8d42cec16131f0c3909edd3d9e089a0
SHA256

3a25af3b277fe9fcb13e72347ce57e1f4f0673e531fcf2ef35d98f1367a06f09
SHA512

2a58a57f21e01bf272b9bc548e08988cc3f2c0ec56fdf073f47022a10e2f2c56e3c8d8859455306c6842b2eec1bca75e9290eb12f77aec14ef83d2b873e619cf
SSDEEP

24576:prRbRdEm9YVdd6HwhIprvSUU61Oim5lo8:plbnkdY9Mlo8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/4364-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4364-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3100-29-0x00000000042F0000-0x0000000004483000-memory.dmp	xmrig
behavioral2/memory/3100-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3100-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3100-30-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral2/memory/3100-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3100	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3100	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4364-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00090000000234a2-11.dat	upx
behavioral2/memory/3100-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4364	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4364	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe
3100	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3100	4364	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe	87
PID 4364 wrote to memory of 3100	4364	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe	87
PID 4364 wrote to memory of 3100	4364	3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c90d12d57bd7a1ebc9141e7956486f8_JaffaCakes118.exe

Filesize
784KB

MD5
69db03f10201a0aa014dbbadaef70f6b

SHA1
fdf8f660d098239de30e28c8254bbb7452e5f162

SHA256
783cbc8443d24050002ff40aa97c8f6dbef0826dbedabfaa79b3350354ae2a74

SHA512
b341ab209a1d01e4db7944fe3ebb5105164986f1e016de7de690a9be92871027c80518e4fd534e45868d2b482b395fb819c017ff497321276f24826766a2d379

Download Submit
memory/3100-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3100-19-0x0000000001A80000-0x0000000001B44000-memory.dmp

Filesize
784KB

Download
memory/3100-29-0x00000000042F0000-0x0000000004483000-memory.dmp

Filesize
1.6MB

Download
memory/3100-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3100-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3100-30-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/3100-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4364-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4364-1-0x0000000001A90000-0x0000000001B54000-memory.dmp

Filesize
784KB

Download
memory/4364-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4364-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download