xmrig | baf582dbb3a3e0656c8263901bb4c7acebda4872d3a8c3f2fb50edbd96cb4d02

Analysis

max time kernel
131s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b05817cacf7c32461653207909ed047f_JaffaCakes118.exe
Size

784KB
MD5

b05817cacf7c32461653207909ed047f
SHA1

a58971473a46e8a8cd0e868cf68f9699418b88b8
SHA256

baf582dbb3a3e0656c8263901bb4c7acebda4872d3a8c3f2fb50edbd96cb4d02
SHA512

2741ed480692a42c6628a3c7410a22ea4375708a622d3ea3910bb8d2b3ed9ebe8ae81ef8df6af43f5cc625fcd6ae380ddfa43d994458b9f11725bcd36571a359
SSDEEP

24576:OZv89SUaRNxrBf4KbfNsbXAvI9RwNvfsXWbZ/b:OZ5Nl9+bH8xfsXMZ

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/5048-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/5048-13-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4352-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4352-20-0x0000000005470000-0x0000000005603000-memory.dmp	xmrig
behavioral2/memory/4352-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/4352-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4352	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4352	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5048-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0008000000023412-11.dat	upx
behavioral2/memory/4352-12-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5048	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5048	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe
4352	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4352	5048	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4352	5048	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe	86
PID 5048 wrote to memory of 4352	5048	b05817cacf7c32461653207909ed047f_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\b05817cacf7c32461653207909ed047f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b05817cacf7c32461653207909ed047f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\b05817cacf7c32461653207909ed047f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b05817cacf7c32461653207909ed047f_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b05817cacf7c32461653207909ed047f_JaffaCakes118.exe

Filesize
784KB

MD5
93b1155e3611a2c4154efb8bedad68b8

SHA1
e1056797275052763d06f830ee0854def60ddfd3

SHA256
9bf6e2ae80bd55c03f4adf5e4c37e7b882753f60fa04d7a7c36e9b9071c2f95a

SHA512
90b62cc96daa7b753a04935fcffd9fb9a14342d0f86d91b454e6b264ab70612e74f3026a7910e83be63ce87648ce7cb3fc561e5dd39fa99160e48694bd19dac7

Download Submit
memory/4352-12-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4352-19-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4352-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4352-20-0x0000000005470000-0x0000000005603000-memory.dmp

Filesize
1.6MB

Download
memory/4352-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4352-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/5048-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/5048-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/5048-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5048-13-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download