xmrig | c12731c930aa2fc0c8759df733894d94507e368eed0b9424801b3e709bbfc880

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ad852eebdaaaca8f887b5d0536b40a0N.exe
Size

784KB
MD5

5ad852eebdaaaca8f887b5d0536b40a0
SHA1

0dad3103d036fa8459956061279e948528a26ae7
SHA256

c12731c930aa2fc0c8759df733894d94507e368eed0b9424801b3e709bbfc880
SHA512

dafe72ed11b9eef6446feb94665984a39fbaf08b0db4106cd38f54736220f828167edf9cc8451fc6a1d13dcb2733b0b7e1bb1079e0c3417511bbbcf09648f78c
SSDEEP

24576:gFnfE1bTS8bgiyDGZUWORET8CAewlSrVT:gFnfE1Xbgi9DOlnlyT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2836-3-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2836-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3116-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3116-20-0x0000000005430000-0x00000000055C3000-memory.dmp	xmrig
behavioral2/memory/3116-22-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3116-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3116	5ad852eebdaaaca8f887b5d0536b40a0N.exe

Executes dropped EXE 1 IoCs

pid	Process
3116	5ad852eebdaaaca8f887b5d0536b40a0N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2836-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00090000000233f0-11.dat	upx
behavioral2/memory/3116-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2836	5ad852eebdaaaca8f887b5d0536b40a0N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2836	5ad852eebdaaaca8f887b5d0536b40a0N.exe
3116	5ad852eebdaaaca8f887b5d0536b40a0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3116	2836	5ad852eebdaaaca8f887b5d0536b40a0N.exe	87
PID 2836 wrote to memory of 3116	2836	5ad852eebdaaaca8f887b5d0536b40a0N.exe	87
PID 2836 wrote to memory of 3116	2836	5ad852eebdaaaca8f887b5d0536b40a0N.exe	87

C:\Users\Admin\AppData\Local\Temp\5ad852eebdaaaca8f887b5d0536b40a0N.exe
"C:\Users\Admin\AppData\Local\Temp\5ad852eebdaaaca8f887b5d0536b40a0N.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\5ad852eebdaaaca8f887b5d0536b40a0N.exe
  C:\Users\Admin\AppData\Local\Temp\5ad852eebdaaaca8f887b5d0536b40a0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5ad852eebdaaaca8f887b5d0536b40a0N.exe

Filesize
784KB

MD5
41e097ff4f0b8b8bf1ba4bb8182aa726

SHA1
bc712f3153901444f8f3a08f462a1bd5e7006b5b

SHA256
afdd66f2aa6ebcb9b74aab072d4b6e78ab59fc24097ddf7536e4fdbdc5fe3062

SHA512
73b2cecddf9bab5024faa52b567067b0248670df439d100df3d2150ee1cd78f0a28e04bbafa68d6f7004bfc61ace64b7f3cfb8b96159d2d83b93ce01fbef5caf

Download Submit
memory/2836-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2836-1-0x00000000018E0000-0x00000000019A4000-memory.dmp

Filesize
784KB

Download
memory/2836-3-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2836-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3116-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3116-14-0x0000000001A40000-0x0000000001B04000-memory.dmp

Filesize
784KB

Download
memory/3116-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3116-20-0x0000000005430000-0x00000000055C3000-memory.dmp

Filesize
1.6MB

Download
memory/3116-22-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3116-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download