xmrig | 03a021df8695b981a47b4d9b10a9b3eb5efe759664307c3dc7a5be05d04cd3f9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe
Size

784KB
MD5

43a49a1c3b90e290b0cd7bba472e9db9
SHA1

9fa1a9ad0bae414d4883a9e4836825c7305cb2da
SHA256

03a021df8695b981a47b4d9b10a9b3eb5efe759664307c3dc7a5be05d04cd3f9
SHA512

b8737cc67991535f1543b32c48e53d7655f48263afaf221963d9df757aeeaba08f4b9f73784e75364dd911269c454cdd7a2403103ef1ae1eab5aa04ac87658d6
SSDEEP

12288:clUzEsuKAGsuWARoYN9FVSkyZarcXNrH3g1ZRZjbnRNkFHhx09XlOtXNRt9CFiJr:5upKoYNVSvZage1ZRhzROaXgtrtQna

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/3044-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/3044-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2412-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2412-23-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2412-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2412-33-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2412-32-0x0000000002FD0000-0x0000000003163000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2412	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x0009000000012117-15.dat	upx
behavioral1/memory/2412-16-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe
2412	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2412	3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2412	3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2412	3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2412	3044	43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\43a49a1c3b90e290b0cd7bba472e9db9_JaffaCakes118.exe

Filesize
784KB

MD5
854dd3ce53822b1dc0221b0a174e6393

SHA1
043a3593ae5e320f0a99e4cfd77a6830bbfb2604

SHA256
bb661a472dfeb8ab913c4694b3d3d92e511fa76bf69c20fa60a17333b40e9ac1

SHA512
bf8a95dc945495fb2579b204e8f3810d1ac6bbd244dbe0eab227890ff88c6df1132d5270c0f678caa313a965ae8e02bf7ab245ae50b32ece615a7915b5185156

Download Submit
memory/2412-16-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2412-17-0x00000000002C0000-0x0000000000384000-memory.dmp

Filesize
784KB

Download
memory/2412-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2412-23-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2412-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2412-33-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2412-32-0x0000000002FD0000-0x0000000003163000-memory.dmp

Filesize
1.6MB

Download
memory/3044-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3044-4-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/3044-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3044-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download