xmrig | 7e306d99217845dae6f20c6cec1b0a5cca836281b5d076185d06fdfa840117c2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe
Size

784KB
MD5

4b2876bcc9b3639fefa7b5ecf1144dab
SHA1

456f0a432861bdfb832de6878acf7c19acd90ef8
SHA256

7e306d99217845dae6f20c6cec1b0a5cca836281b5d076185d06fdfa840117c2
SHA512

c9b1ff9cc2e46eeafbf654e1f7e26061d3be8075e35c4e7f02f34015e0fefeabfd2268f10043a5fb50000dfe6d89073d20d79012967007962aca26cf18406811
SSDEEP

24576:koiKQo0fo5qQMghpzp64NdMWcc8B3HgE3X0:Uy8o5SghPVdMm8BV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3180-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3180-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2856-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2856-20-0x0000000005480000-0x0000000005613000-memory.dmp	xmrig
behavioral2/memory/2856-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2856-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2856	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3180-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000a0000000234aa-11.dat	upx
behavioral2/memory/2856-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3180	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3180	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe
2856	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 2856	3180	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe	87
PID 3180 wrote to memory of 2856	3180	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe	87
PID 3180 wrote to memory of 2856	3180	4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Admin\AppData\Local\Temp\4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4b2876bcc9b3639fefa7b5ecf1144dab_JaffaCakes118.exe

Filesize
784KB

MD5
5cc01635eadda048556b1257c171c454

SHA1
cd3658432c7bbeceba30b77dad684ace5e7d3684

SHA256
68f02e72b69b75280a28b1db2457e0b6ea7ed72dde40daf3726c8d18322f410e

SHA512
eb4d8f9b17841764d242773051569c65b57675debe81d15afcdf5cfbd79b21de22c23cfd7d9b6a5eb9ae82cec32b7ea1a7bc511e7fbdae30653d4028576b86ef

Download Submit
memory/2856-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2856-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2856-14-0x0000000001A90000-0x0000000001B54000-memory.dmp

Filesize
784KB

Download
memory/2856-20-0x0000000005480000-0x0000000005613000-memory.dmp

Filesize
1.6MB

Download
memory/2856-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2856-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3180-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3180-1-0x0000000001900000-0x00000000019C4000-memory.dmp

Filesize
784KB

Download
memory/3180-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3180-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download