xmrig | a5ce556ba2586190a98fcfdaeaeec97e763419b8b367da069d762f322a74390a | Triage

Resubmissions

12/09/2024, 10:43

240912-msrnhasdlb 10

12/09/2024, 10:43

240912-msjb5ascrr 10

12/09/2024, 09:10

240912-k498wazgrd 10

12/09/2024, 09:10

240912-k49bkszgrb 10

12/09/2024, 09:10

240912-k48eaazgqh 10

09/09/2024, 17:06

240909-vmsydazcjm 10

09/09/2024, 17:05

240909-vl4y9azbqk 10

09/09/2024, 17:05

240909-vlxj6s1hmf 10

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 17:05

Sharing

Report Analysis Logs

General

Target

xmrig-6.22.0-gcc-win64 plus/14Kryptex-ETC-Rigel.bat
Size

92B
MD5

634f74bb86bbee797fb3fd78bb981c69
SHA1

dacc178885db2349ad47b9e8d2fb6140dbb7ca61
SHA256

4c42750d70f4097dd4de26367a7ee25704bca438e82476c4e9481246d067b632
SHA512

07d76ed885fefa28765cfe3b6c42213fb43c6ec709a82aa7245c8896fe4e79b7d672fcf3043a658ed034e27449e9921f5120a911cb0a0ce8667d819e6d2720ef

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

resource	yara_rule
behavioral9/memory/2156-0-0x000000013F440000-0x0000000140072000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2156	2360	cmd.exe	31
PID 2360 wrote to memory of 2156	2360	cmd.exe	31
PID 2360 wrote to memory of 2156	2360	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0-gcc-win64 plus\14Kryptex-ETC-Rigel.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.0-gcc-win64 plus\xmrig.exe
  xmrig --coin XMR --url "xmr.kryptex.network:7777" --user "[email protected]/WORKER_NAME"
  2⤵
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x000000013F440000-0x0000000140072000-memory.dmp

Filesize
12.2MB

Download