xmrig | f5410d72a492a136f479da93d4775f398eba60c44b6f2373834b6f4f55bc330f

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe
Size

784KB
MD5

d46a3f675f0296a94b353e635bbac0e6
SHA1

bda4ed9fc11155f8d7754293d0b1311c63c5094a
SHA256

f5410d72a492a136f479da93d4775f398eba60c44b6f2373834b6f4f55bc330f
SHA512

f4a6ab5021225e9887b56bf453cb405bd4bc3b96decfad07cabf1987afcd422cf77be5d2188736df36b321ba3a33e8c887441b2d14fd554cfb1e3d4c3b932d03
SSDEEP

24576:sM/aJ1Bh5K+EaWPrC3pqeY9WUT21yI9Szs3jXtYAO3:sM/oksWWDYYUT21Ys3jtO

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3060-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3060-13-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/5076-17-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/5076-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/5076-30-0x0000000005430000-0x00000000055C3000-memory.dmp	xmrig
behavioral2/memory/5076-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
5076	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
5076	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3060-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0008000000023427-12.dat	upx
behavioral2/memory/5076-14-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3060	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3060	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe
5076	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 5076	3060	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe	85
PID 3060 wrote to memory of 5076	3060	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe	85
PID 3060 wrote to memory of 5076	3060	d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d46a3f675f0296a94b353e635bbac0e6_JaffaCakes118.exe

Filesize
784KB

MD5
d7013190f0dce0f3752246042b30cc0a

SHA1
cd98598255d7d1ee3204cf4a6b5f4d112f303424

SHA256
e27d66baabd9bfec034a7d7dc71a80d8e07b835b39f705a5e7291cf7608b4415

SHA512
518b79a086eaae2d06db4f886ae74eeae6acf3b0774e5a30e773c0b1daf5d9f4c98aca7e15b521a545a74e1736519f72e5a69ca054a8a28455cce9c68319c26d

Download Submit
memory/3060-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3060-1-0x00000000017F0000-0x00000000018B4000-memory.dmp

Filesize
784KB

Download
memory/3060-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3060-13-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5076-14-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/5076-15-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/5076-17-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5076-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/5076-30-0x0000000005430000-0x00000000055C3000-memory.dmp

Filesize
1.6MB

Download
memory/5076-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download