xmrig | e466aa81acc4b176584fce81f08b1cbdace88fd32d4171d3391a1ace2211e66d

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe
Size

784KB
MD5

a73a42907d0f656520376d1d8f1c30c9
SHA1

3ca23d179a70e84de3cb29283a33db02bec1dfee
SHA256

e466aa81acc4b176584fce81f08b1cbdace88fd32d4171d3391a1ace2211e66d
SHA512

f01106a7170bf160dd54af6722a43e4006aa07951e1ee2b158eb7a07017f4dc1f31f058854e0332d0decfdd81b18a2d7e8492e1e9e42e802801411a5b7dc5c8b
SSDEEP

24576:GnHPC4+c2PBIfUyE6MdrBhC7tnwRnqymDw:GnUc25yUvlC7CxqymD

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4288-3-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4288-13-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2944-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2944-29-0x00000000053A0000-0x0000000005533000-memory.dmp	xmrig
behavioral2/memory/2944-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2944-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2944	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4288-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0008000000023464-11.dat	upx
behavioral2/memory/2944-12-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4288	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4288	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe
2944	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2944	4288	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe	86
PID 4288 wrote to memory of 2944	4288	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe	86
PID 4288 wrote to memory of 2944	4288	a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a73a42907d0f656520376d1d8f1c30c9_JaffaCakes118.exe

Filesize
784KB

MD5
9b6cd2a5f717a43d32bdcfe7a2cbb5c7

SHA1
a10e55c68f584a78ff4d88defaa3003ec97b1aec

SHA256
3219d9cf5310acdf479638d45e07287b16b11a55a3022aa2ed4d02fcf585d955

SHA512
265cd533348e1fbe6db65e66b928f99bf8346574526f719f25d710873cd8507662bbf45656316d92ac71666d1cbfd5d0cb1694d0138953ed000ba3b7f72954f5

Download Submit
memory/2944-12-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2944-14-0x00000000017F0000-0x00000000018B4000-memory.dmp

Filesize
784KB

Download
memory/2944-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2944-29-0x00000000053A0000-0x0000000005533000-memory.dmp

Filesize
1.6MB

Download
memory/2944-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2944-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4288-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4288-1-0x0000000001AE0000-0x0000000001BA4000-memory.dmp

Filesize
784KB

Download
memory/4288-3-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4288-13-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download