xmrig | ec792e81924ae3666f0edd144a489d8963981afbffc5f4c60642c5b3921845ae

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe
Size

784KB
MD5

42518c9905de1f4ec58fdbc26bfccc4c
SHA1

da3f357d28ae20d8693a5a7484f44f961c126b5c
SHA256

ec792e81924ae3666f0edd144a489d8963981afbffc5f4c60642c5b3921845ae
SHA512

8cf2483b327e31191844f08f9a3d3e5feed3dacd1ddd5a6f7a21c2846bb912bcd61a2284051f49b71b1aa01dd0f7d089efc2a7474ba45ded162b1d837848569d
SSDEEP

24576:UhiKNHqJDAXwTUO3aU/Roe4o4e8v1IGmvJI49:UhBqJDywT0UVt8v4I4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2176-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2176-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2532-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2532-33-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2532-32-0x00000000031F0000-0x0000000003383000-memory.dmp	xmrig
behavioral1/memory/2532-34-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2532-22-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2176-35-0x0000000003080000-0x0000000003392000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2532	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2532	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x000b00000001202f-10.dat	upx
behavioral1/memory/2176-15-0x0000000003080000-0x0000000003392000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe
2532	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2532	2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2532	2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2532	2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2532	2176	42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\42518c9905de1f4ec58fdbc26bfccc4c_JaffaCakes118.exe

Filesize
784KB

MD5
f077342112126d52ea3f98f80cfcaf01

SHA1
bfa0d65525d48c98e94268f274203082d34743ae

SHA256
d1575e56917d3a4d0f632592a9a56100fe97e7ddb30c33756b65961fe8499723

SHA512
e8a8a51d34ce5d6c3517772b329139d47b97ebac4d0944bfe6fb2e5993da8215f48739fca72681f97e595a5050a8b4839cf807c73c5c028b4853f880a6cd2f88

Download Submit
memory/2176-35-0x0000000003080000-0x0000000003392000-memory.dmp

Filesize
3.1MB

Download
memory/2176-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2176-2-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2176-15-0x0000000003080000-0x0000000003392000-memory.dmp

Filesize
3.1MB

Download
memory/2176-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2176-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2532-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2532-32-0x00000000031F0000-0x0000000003383000-memory.dmp

Filesize
1.6MB

Download
memory/2532-34-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2532-22-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2532-23-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2532-33-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download