xmrig | e3c6877d5cd6d788b4b96b7aa438b30bde43add8840b12bb29d1ffaf93272306

Analysis

max time kernel
75s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe
Size

784KB
MD5

969a117d68177e9fa152b7348c4d6941
SHA1

5cf86c17c3a50f0f1195a566019382103ba6dd14
SHA256

e3c6877d5cd6d788b4b96b7aa438b30bde43add8840b12bb29d1ffaf93272306
SHA512

bb68b6deaf0c6b73b2554d67e135c89f0d265857bf6990879bb92f5b641979fe463541f151eda6931f5a58e575cd4128458f3a8213a8883965c5b564a8753372
SSDEEP

24576:6BswDpJN3fv85jsGJIXJmD83N8Vj7SXToECDOWW:6XNPv85wGJt83NaqXUS

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/1772-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1772-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1892-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1892-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1892-29-0x0000000005410000-0x00000000055A3000-memory.dmp	xmrig
behavioral2/memory/1892-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1892	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1892	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1772-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0008000000023470-11.dat	upx
behavioral2/memory/1892-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1772	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1772	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe
1892	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1892	1772	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe	87
PID 1772 wrote to memory of 1892	1772	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe	87
PID 1772 wrote to memory of 1892	1772	969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\969a117d68177e9fa152b7348c4d6941_JaffaCakes118.exe

Filesize
784KB

MD5
47a8984e1fb82c66d8e86dbdd011d5d7

SHA1
1c5f2d76b2203ea8caf44685487d812f7e7b8184

SHA256
461d37b83ec8a5a3805db21d8deb85cc98df296e7cefa4f06963ef6a4ca94e44

SHA512
c346d3c0edacd6e0ac23cd5c006e29ae3b39983db86c4fb06afad1402d6abf2f38380e2103c379a6672b3d8071fdb1bc35ecb87ecdee60ec3443b62ef641982c

Download Submit
memory/1772-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1772-1-0x00000000018C0000-0x0000000001984000-memory.dmp

Filesize
784KB

Download
memory/1772-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1772-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1892-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1892-16-0x0000000001A20000-0x0000000001AE4000-memory.dmp

Filesize
784KB

Download
memory/1892-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1892-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1892-29-0x0000000005410000-0x00000000055A3000-memory.dmp

Filesize
1.6MB

Download
memory/1892-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download