xmrig | cb2946d049291d2da4abf3d6b98307c541b9856a5cc045d4bc4b5980e80d7baf

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
Size

784KB
MD5

bd3e3d2727ba5a17d14498b17bb4378a
SHA1

fb34955e3bf2044a9ebe07d46262e0d4f2af8235
SHA256

cb2946d049291d2da4abf3d6b98307c541b9856a5cc045d4bc4b5980e80d7baf
SHA512

93ab18345e309bb092deab3f2d41b3b40e7305dcb9a0481d2e7eb0edd370fe0383e37279ca7f56f074bea70cff5c39d4f4804e308ffa740d01192a8905b4f640
SSDEEP

24576:gk3kfzoHCxAasiQ04qMbiSjqPtJO2J+L:gk3k7oGVWjbiSe+2YL

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/4568-3-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4568-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2664-16-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2664-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2664-30-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral2/memory/2664-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2664-29-0x0000000005370000-0x0000000005503000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2664	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4568-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0008000000023481-11.dat	upx
behavioral2/memory/2664-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4568	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4568	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
2664	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2664	4568	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2664	4568	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2664	4568	bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe

Filesize
784KB

MD5
05b699f969263544917daef32355052c

SHA1
def452218da07db72ea776dfb628e60fe0798b37

SHA256
185e164289f65ce6d86a81b0f299d28eee542ed68a9007971930d6f9467abab7

SHA512
247fdb975b5bb1944223cc3bb8ef67edcd9e5c1a74790e712e32aa473acf4987e23824dce08cc08a15c9ab077e80c7e41c071f4b18313161465cea3d94c7085e

Download Submit
memory/2664-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2664-14-0x0000000001B00000-0x0000000001BC4000-memory.dmp

Filesize
784KB

Download
memory/2664-16-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2664-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2664-30-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2664-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2664-29-0x0000000005370000-0x0000000005503000-memory.dmp

Filesize
1.6MB

Download
memory/4568-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4568-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/4568-3-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4568-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download