xmrig | 69e8c9a7a1638436fff5fc42195dd9b6e4f5ab2fbc8416638344de179acb5a45

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe
Size

784KB
MD5

47537507bfa1cca66e71d2bb20578fd5
SHA1

50aecd444d32c4e45c44e5f680c20b9319d5f8e5
SHA256

69e8c9a7a1638436fff5fc42195dd9b6e4f5ab2fbc8416638344de179acb5a45
SHA512

f8e1b12b24a6f11b34b4e279db83572e242ada9d228db28e5ddbc3f542673897196666f441b2bfeceb4b0629b3a2641bca2110d9de396d93dc213ec078d8fd52
SSDEEP

24576:zPZn0etAzr+6SYZXtIymvCJ6hYpp6y7dZpJI9:zRnztw+D8X3mFhY/6IJy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2876-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2876-16-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2876-14-0x0000000003220000-0x0000000003532000-memory.dmp	xmrig
behavioral1/memory/2272-18-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/2272-33-0x0000000003110000-0x00000000032A3000-memory.dmp	xmrig
behavioral1/memory/2272-34-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral1/memory/2272-35-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral1/memory/2272-24-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2272	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2272	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/files/0x0009000000012119-10.dat	upx
behavioral1/memory/2272-17-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe
2272	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2272	2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2272	2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2272	2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2272	2876	47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\47537507bfa1cca66e71d2bb20578fd5_JaffaCakes118.exe

Filesize
784KB

MD5
663febedf2f3023cb7c5f5786a1ed09f

SHA1
0faf5d2a2df3d77e039e0e169ed3ba4753a9433a

SHA256
c0287b72b5144e9aad0973b522ae4f878c38626fec6a483490745224575e7cd4

SHA512
3e0813dfcb099378ac14e7245a4ba35fbc0a5146bd4852d06defbd7635d4966f0a0578baacb7efdd365ccc12b2338ef793de0388a56b3aebcb35598846afa26f

Download Submit
memory/2272-23-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2272-17-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2272-18-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2272-33-0x0000000003110000-0x00000000032A3000-memory.dmp

Filesize
1.6MB

Download
memory/2272-34-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2272-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2272-24-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2876-9-0x0000000000120000-0x00000000001E4000-memory.dmp

Filesize
784KB

Download
memory/2876-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2876-16-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2876-14-0x0000000003220000-0x0000000003532000-memory.dmp

Filesize
3.1MB

Download
memory/2876-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download