xmrig | d4062146de6cb9fbc59145f9b19141388de2bd1ced93c44fa80a8c4d0641ed8e

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe
Size

784KB
MD5

87abd486935ce5a10097723a98b59f02
SHA1

ce53c5a0983ca1d6afa6d3507d29b43be0720c44
SHA256

d4062146de6cb9fbc59145f9b19141388de2bd1ced93c44fa80a8c4d0641ed8e
SHA512

5184ee43d0359f6cdb17879869047c6f2b46f5fa61693762aa192a77ce4cc2b93ed8d719e9d5e032bf98ed9ce94f6106fcfb39faae4e19789ffb01c988a2205e
SSDEEP

24576:RL96FvU8PaUt9mpdpB6DRUVBqlND1Esv:FAFvpSUmfBeRKqltZ

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2108-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2108-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4060-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4060-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4060-20-0x0000000005410000-0x00000000055A3000-memory.dmp	xmrig
behavioral2/memory/4060-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4060	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2108-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0008000000023436-11.dat	upx
behavioral2/memory/4060-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2108	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2108	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe
4060	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4060	2108	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe	85
PID 2108 wrote to memory of 4060	2108	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe	85
PID 2108 wrote to memory of 4060	2108	87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\87abd486935ce5a10097723a98b59f02_JaffaCakes118.exe

Filesize
784KB

MD5
773d9bdd5a34ce0f99164343479c6652

SHA1
43d2b0b6492ca3b32e30db9e3bba05bb318eba56

SHA256
6728d086860ceafadfb4d14d00860d9af06a09b0ffc668e1f2627e8e9104d882

SHA512
5eed6b27499f169b275065e28f30e802fe05aa7db9e3367e16341f965f8ea007cf61aab3cd042e8e90ba7dbbf47a6ca440c6f6867a430a96ab7947d52a5051a6

Download Submit
memory/2108-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2108-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/2108-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2108-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4060-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4060-14-0x0000000001A20000-0x0000000001AE4000-memory.dmp

Filesize
784KB

Download
memory/4060-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4060-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4060-20-0x0000000005410000-0x00000000055A3000-memory.dmp

Filesize
1.6MB

Download
memory/4060-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download