xmrig | ORIGIN BETA[.]zip

Target
ORIGIN BETA.zip
Size 3.7MB
Sample240903-kkmcpsscml
SHA256 98bff6077e90c22a103bc92e0e746b0d84081a5da428b7005275f51d221c2019
MD5 571abaf3583965e054e38193d128abef
SHA1 c11c1496221ff5c1550f460c5522ca3aa9ab266a
SHA512 1a5d3cc58a0e0d2c896e4c12b75537156d8b0e53e63a2f611155e1ebc939b495475aa229796dc9bfe52c1ab759bbd24a58a8cc6c27472ddb2db4123666697f25
SSDEEP 98304:QsvYBDD+sOg66q67bDp51+re1aAA717SmESMy7dglIuJG3/:30DKPg6i7bP1eSA71eRSMy7qIukv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
static1/unpack001/ORIGIN BETA/xmrig.exe	xmrig
static1/unpack001/ORIGIN BETA/xmrig.exe	family_xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ORIGIN BETA/xmrig.exe

File Explorer

ORIGIN BETA.zip

.zip 3.7MB
ORIGIN BETA/1Kryptex-ETC-Rigel.bat

92B
ORIGIN BETA/2Kryptex-ETC-Rigel.bat

92B
ORIGIN BETA/Kryptex-ETC-Rigel.bat

92B
ORIGIN BETA/WinRing0x64.sys

.sys 14KB
ORIGIN BETA/xmrig.exe

.exe 9.1MB

ORIGIN BETA.zip

SHA256 98bff6077e90c22a103bc92e0e746b0d84081a5da428b7005275f51d221c2019
MD5 571abaf3583965e054e38193d128abef
SHA1 c11c1496221ff5c1550f460c5522ca3aa9ab266a
SHA512 1a5d3cc58a0e0d2c896e4c12b75537156d8b0e53e63a2f611155e1ebc939b495475aa229796dc9bfe52c1ab759bbd24a58a8cc6c27472ddb2db4123666697f25
SSDEEP 98304:QsvYBDD+sOg66q67bDp51+re1aAA717SmESMy7dglIuJG3/:30DKPg6i7bP1eSA71eRSMy7qIukv
MD5 SHA1 SHA512 SSDEEP

ORIGIN BETA/WinRing0x64.sys

IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Chains

Jul 26, 2008

Subject

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Serial Number

01:00:00:00:00:01:15:37:24:21:a8

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Timespan

Sep 24, 2007 - Sep 24, 2008

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:00:f9:7f:aa:2e:1e

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 16, 2003 - Jan 27, 2014

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:1c:d6

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 28, 1999 - Jan 27, 2014

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Serial Number

04:00:00:00:00:01:10:92:eb:82:95

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 5, 2007 - Jan 27, 2014

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:24:48

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2014

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:0b:7f:6b:00:00:00:00:00:19

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

20488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb

Name

.text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ORIGIN BETA/xmrig.exe

IMPHASH 0a60d98d529c56f82bfac35997fa6601
SHA256 e5cd22ffe8725fbabf32ae2ba993d5b791e65e2ef159ad32ad260505f2e22480
MD5 d6c24bdff1cb0f2fcbe5ae63c42c7d92
SHA1 6412934a06c3221a25ed1986098ec57d0c221cd8
SHA512 f8f028ebafcc96fd97984494c4773093be5b5e5eae820e3ae0097d101f8962d320863adcc944763104f0ad5efed01c3c6be88797fd9c40e5258642c5b325a2a6
SSDEEP 98304:LDbwKIstlHlMiXZgE3PhfUXMyf3477f37LmCMMK85CGi+6o4euU/XErD4cNaHd/4:j75izJSHFbs1lvp33
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CloseServiceHandle ControlService CreateServiceW CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEnumProvidersW CryptExportKey CryptGenRandom CryptGetProvParam CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeleteService DeregisterEventSource FreeSid GetSecurityInfo GetTokenInformation GetUserNameW LookupPrivilegeValueW LsaAddAccountRights LsaClose LsaOpenPolicy OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigA QueryServiceStatus RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW SetEntriesInAclA SetSecurityInfo StartServiceW SystemFunction036

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

dbghelp

MiniDumpWriteDump SymGetOptions SymSetOptions

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceLuidToNameW GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CancelIoEx CancelSynchronousIo CloseHandle ConnectNamedPipe ConvertFiberToThread ConvertThreadToFiberEx CopyFileW CreateDirectoryW CreateEventA CreateFiberEx CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateSymbolicLinkW CreateToolhelp32Snapshot DebugBreak DeleteCriticalSection DeleteFiber DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsA FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterW FindClose FindFirstFileW FindNextFileW FindResourceW FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetComputerNameA GetConsoleCursorInfo GetConsoleMode GetConsoleScreenBufferInfo GetConsoleTitleW GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetHandleInformation GetLargePageMinimum GetLastError GetLongPathNameW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeHandleStateA GetNamedPipeServerProcessId GetNativeSystemInfo GetNumberOfConsoleInputEvents GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemDirectoryA GetSystemFirmwareTable GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVersion GetVersionExA GetVersionExW GlobalMemoryStatusEx HeapAlloc HeapFree InitializeConditionVariable InitializeCriticalSection InitializeSRWLock IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent K32GetModuleBaseNameW K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MoveFileExW MultiByteToWideChar NeedCurrentDirectoryForExePathW OpenProcess OutputDebugStringA PeekNamedPipe PostQueuedCompletionStatus Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReOpenFile ReadConsoleA ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetConsoleTitleA SetConsoleTitleW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetEvent SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetSystemTime SetThreadAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableCS SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection UnmapViewOfFile UnregisterWait UnregisterWaitEx VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleInputW WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __argv __doserrno __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _close _commode _endthreadex _errno _exit _fileno _fdopen _fileno _findclose _findfirst64 _findnext64 _fmode _fstat64 _fullpath _get_osfhandle _gmtime64 _initterm _isatty _localtime64 _lock _lseeki64 _mkdir _onexit _open _open_osfhandle _read _setjmp _setmode _snwprintf _snwprintf_s _stat64 _strdup _strdup _stricmp _strnicmp _strtoi64 _strtoui64 _time64 _umask _unlock _vscprintf _vsnprintf _vsnwprintf _wchmod _wcsdup _wcsnicmp _wcsrev _wfopen _wopen _write _write _wrmdir abort atof atoi calloc exit fclose feof ferror fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwrite getc getenv isspace iswctype isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset printf qsort raise rand realloc setlocale setvbuf signal sprintf srand strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncmp strncpy strrchr strspn strstr strtol strtoul strxfrm tolower toupper towlower towupper ungetc vfprintf wcschr wcscmp wcscoll wcscpy wcsftime wcslen wcsncmp wcsncpy wcspbrk wcsrchr wcsstr wcstombs wcsxfrm

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathA

user32

DispatchMessageA GetLastInputInfo GetMessageA GetProcessWindowStation GetSystemMetrics GetUserObjectInformationW MapVirtualKeyW MessageBoxW ShowWindow TranslateMessage

userenv

GetUserProfileDirectoryW

ws2_32

FreeAddrInfoW GetAddrInfoW WSACleanup WSADuplicateSocketW WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSASocketW WSAStartup accept bind closesocket connect gethostbyaddr gethostbyname gethostname getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohs recv select send setsockopt shutdown socket

Name

.text

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

231KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ORIGIN BETA.zip

ORIGIN BETA/1Kryptex-ETC-Rigel.bat

ORIGIN BETA/2Kryptex-ETC-Rigel.bat

ORIGIN BETA/Kryptex-ETC-Rigel.bat

ORIGIN BETA/WinRing0x64.sys

PE Signature issue

ntoskrnl.exe

hal

generic

ORIGIN BETA/xmrig.exe

advapi32

crypt32

dbghelp

iphlpapi

kernel32

msvcrt

ole32

shell32

user32

userenv

ws2_32

generic