xmrig | ab1a9dd2f522b12e307f1c4d0c676b97663d4c31f050ce28f2249572bdafc97f

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

95af97081495b36c5672d453f971fd24_JaffaCakes118.exe
Size

784KB
MD5

95af97081495b36c5672d453f971fd24
SHA1

8434652eb4af837515d9a8bcb1c2afafb30e728f
SHA256

ab1a9dd2f522b12e307f1c4d0c676b97663d4c31f050ce28f2249572bdafc97f
SHA512

327326ab2daeac6261eb0ed38cddfe279ed0c4506e375bc078fc095b615a177e90e77098b9a02bcd385da23d2cebea269bdbd6476111b46bf5d4e8062b7bf72c
SSDEEP

12288:j8YVEqoXM/yxQa88taz2udnYPZHFXTyy9wzOMrq8YdpExgUMvq/Gov2Av6n:QdM2Q4u2udYPZHRxwb6zweKdbin

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4100-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4100-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2496-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2496-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2496-29-0x0000000005410000-0x00000000055A3000-memory.dmp	xmrig
behavioral2/memory/2496-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2496	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4100-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000800000002340f-11.dat	upx
behavioral2/memory/2496-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4100	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4100	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe
2496	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2496	4100	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe	86
PID 4100 wrote to memory of 2496	4100	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe	86
PID 4100 wrote to memory of 2496	4100	95af97081495b36c5672d453f971fd24_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\95af97081495b36c5672d453f971fd24_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95af97081495b36c5672d453f971fd24_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\95af97081495b36c5672d453f971fd24_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\95af97081495b36c5672d453f971fd24_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95af97081495b36c5672d453f971fd24_JaffaCakes118.exe

Filesize
784KB

MD5
2ecb638add4e2756262f7683dd0fe0e0

SHA1
11c32cefc89a2292e9928065ce78976192271632

SHA256
0edf85335ca6025e157210e237da3fef4abaaf228807c0fde16a8cc41ff5f1b7

SHA512
1ea7f5ff731962cc5ed5af12276167e1f15090581a38c7c0f1cb5cf60fd5d2c3d942d26ab994b9ac714b79705c236bbc07b72a7f5c04533b0367a29d5174416d

Download Submit
memory/2496-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2496-14-0x00000000018E0000-0x00000000019A4000-memory.dmp

Filesize
784KB

Download
memory/2496-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2496-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2496-29-0x0000000005410000-0x00000000055A3000-memory.dmp

Filesize
1.6MB

Download
memory/2496-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4100-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4100-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4100-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4100-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download