xmrig | 98bff6077e90c22a103bc92e0e746b0d84081a5da428b7005275f51d221c2019 | Triage

Resubmissions

03/09/2024, 12:14

240903-pelw7sxeke 10

03/09/2024, 12:12

240903-pdb1lswdjq 10

03/09/2024, 12:11

240903-pck7wswcrm 10

03/09/2024, 08:42

240903-kl4clsscqq 10

03/09/2024, 08:41

240903-klrzkstckc 10

03/09/2024, 08:41

240903-klkv9sscnn 10

03/09/2024, 08:40

240903-klbycstcjd 10

03/09/2024, 08:40

240903-kk236atcja 10

03/09/2024, 08:40

240903-kktrsatbrg 10

Analysis

max time kernel
1556s
max time network
1557s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 08:41

Sharing

Report Analysis Logs

General

Target

ORIGIN BETA/2Kryptex-ETC-Rigel.bat
Size

92B
MD5

634f74bb86bbee797fb3fd78bb981c69
SHA1

dacc178885db2349ad47b9e8d2fb6140dbb7ca61
SHA256

4c42750d70f4097dd4de26367a7ee25704bca438e82476c4e9481246d067b632
SHA512

07d76ed885fefa28765cfe3b6c42213fb43c6ec709a82aa7245c8896fe4e79b7d672fcf3043a658ed034e27449e9921f5120a911cb0a0ce8667d819e6d2720ef

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

resource	yara_rule
behavioral3/memory/2076-0-0x000000013F4F0000-0x0000000140122000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2076	2348	cmd.exe	31
PID 2348 wrote to memory of 2076	2348	cmd.exe	31
PID 2348 wrote to memory of 2076	2348	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ORIGIN BETA\2Kryptex-ETC-Rigel.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\ORIGIN BETA\xmrig.exe
  xmrig --coin XMR --url "xmr.kryptex.network:7777" --user "[email protected]/WORKER_NAME"
  2⤵
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x000000013F4F0000-0x0000000140122000-memory.dmp

Filesize
12.2MB

Download