xmrig | 7e69dd789bf828531848e658682b78cb0c3f35f4b9f1f64c306edff316c1c434

Analysis

max time kernel
130s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/11/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PBVIP6November2024.exe
Size

2.4MB
MD5

29b97b3ad71906522b466fce0d9d2f40
SHA1

4438df1e9d100e9998b48044b2e00949f35627a7
SHA256

7e69dd789bf828531848e658682b78cb0c3f35f4b9f1f64c306edff316c1c434
SHA512

06c97e630e3ac8dfb1c0cf94f8e162570ff085876712e132f7c8bd0dd8edeb7ef0bbc08c4a6573fb6206be9fdf18fa7be0a492f2f60e062c58735aeb62f92f99
SSDEEP

49152:M7VXW0U6kcdssPuL3JuX9yXUYtUHjNOeIkpPWKZdA:M71B0cWSgsNQUnHjweTwKZdA

Score

10^/10

xmrig xworm miner rat trojan

Malware Config

Extracted

Family

xworm

193.161.193.99:58389

Attributes

Install_directory
%AppData%
install_file
windowssession.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012117-5.dat	family_xworm
behavioral1/memory/2408-7-0x0000000000850000-0x000000000086A000-memory.dmp	family_xworm

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/1096-48-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-44-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-60-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-58-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-56-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-55-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-52-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-50-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-46-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-63-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-70-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-71-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-69-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-68-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-67-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-65-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-72-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-73-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/1096-74-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	1096	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
2408	Microsoft Windows Firewall.exe
2108	Windows Host.exe
560	windowssystem.exe
1844	sihost64.exe

Loads dropped DLL 6 IoCs

pid	Process
2520	PBVIP6November2024.exe
2520	PBVIP6November2024.exe
840	cmd.exe
840	cmd.exe
2832	conhost.exe
2832	conhost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 1096	2832	conhost.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2736	conhost.exe
2832	conhost.exe
2832	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	Microsoft Windows Firewall.exe
Token: SeDebugPrivilege	2736	conhost.exe
Token: SeDebugPrivilege	2832	conhost.exe
Token: SeLockMemoryPrivilege	1096	cmd.exe
Token: SeLockMemoryPrivilege	1096	cmd.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2408	2520	PBVIP6November2024.exe	30
PID 2520 wrote to memory of 2408	2520	PBVIP6November2024.exe	30
PID 2520 wrote to memory of 2408	2520	PBVIP6November2024.exe	30
PID 2520 wrote to memory of 2108	2520	PBVIP6November2024.exe	31
PID 2520 wrote to memory of 2108	2520	PBVIP6November2024.exe	31
PID 2520 wrote to memory of 2108	2520	PBVIP6November2024.exe	31
PID 2108 wrote to memory of 2736	2108	Windows Host.exe	33
PID 2108 wrote to memory of 2736	2108	Windows Host.exe	33
PID 2108 wrote to memory of 2736	2108	Windows Host.exe	33
PID 2108 wrote to memory of 2736	2108	Windows Host.exe	33
PID 2736 wrote to memory of 2608	2736	conhost.exe	34
PID 2736 wrote to memory of 2608	2736	conhost.exe	34
PID 2736 wrote to memory of 2608	2736	conhost.exe	34
PID 2608 wrote to memory of 2660	2608	cmd.exe	36
PID 2608 wrote to memory of 2660	2608	cmd.exe	36
PID 2608 wrote to memory of 2660	2608	cmd.exe	36
PID 2736 wrote to memory of 840	2736	conhost.exe	38
PID 2736 wrote to memory of 840	2736	conhost.exe	38
PID 2736 wrote to memory of 840	2736	conhost.exe	38
PID 840 wrote to memory of 560	840	cmd.exe	40
PID 840 wrote to memory of 560	840	cmd.exe	40
PID 840 wrote to memory of 560	840	cmd.exe	40
PID 560 wrote to memory of 2832	560	windowssystem.exe	41
PID 560 wrote to memory of 2832	560	windowssystem.exe	41
PID 560 wrote to memory of 2832	560	windowssystem.exe	41
PID 560 wrote to memory of 2832	560	windowssystem.exe	41
PID 2832 wrote to memory of 1844	2832	conhost.exe	42
PID 2832 wrote to memory of 1844	2832	conhost.exe	42
PID 2832 wrote to memory of 1844	2832	conhost.exe	42
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 2832 wrote to memory of 1096	2832	conhost.exe	43
PID 1844 wrote to memory of 1028	1844	sihost64.exe	44
PID 1844 wrote to memory of 1028	1844	sihost64.exe	44
PID 1844 wrote to memory of 1028	1844	sihost64.exe	44
PID 1844 wrote to memory of 1028	1844	sihost64.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PBVIP6November2024.exe
"C:\Users\Admin\AppData\Local\Temp\PBVIP6November2024.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Roaming\Microsoft Windows Firewall.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft Windows Firewall.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Users\Admin\AppData\Roaming\Windows Host.exe
  "C:\Users\Admin\AppData\Roaming\Windows Host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\Windows Host.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "windowssystem" /tr "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "windowssystem" /tr "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2660
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\windowssystem.exe
        
        C:\Users\Admin\AppData\Local\Temp\windowssystem.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:560
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
        6⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        8⤵
        
        PID:1028
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=8C8EbmDZNjCJEbqC6kv4co3VGYzDTJUz53yGug6NKcsEFeUwSNnimV9MvU8gwBufjU84BKBzz2Gt8ayU6Lo1TJaR7wwjjff --pass=x --cpu-max-threads-hint=50 --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls
        7⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft Windows Firewall.exe

Filesize
79KB

MD5
2dce07aebd947933be67b3036566a785

SHA1
0f4079b8c4cff340bf7a46c9417801333fd1feda

SHA256
de61e9687a15d2a4015cd1bf6ba55c0a30a13ab9cc4b36a7d13565a6625ee839

SHA512
28b5cd12f847a23562f780ccb613c6f4ae23cc352b1133e32ac76b514a61269f3812c1c6cd01f6a4f61e42968313be7aa386b161e371f96bb38ddc1148d9795a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
8a043d9dd43e444209c7c0973c56f1e4

SHA1
e7f2ee01e132a29661b18214f1f73dbeaea8cb44

SHA256
362142f96ffcbb7e65197b6180151c056e404da8cd06a3e776632b6747fa6b8c

SHA512
b5127d22835ebf8af812b075b1f68086589e6fea569a042a9f63d18b4f6c7fae40edfc288cfa13021a6957ad78cd0d72af68ad6f6df00a1bb04d640349925d9c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Host.exe

Filesize
2.1MB

MD5
b7d694fd502112976646a8263687f602

SHA1
c9140674a5b045e888a4ee6b043a0d26fa93d636

SHA256
0cc7f4134aca4c6d2ecede8f386a386c1f56458dc7f2af54acd84b3c1bf789a5

SHA512
ee346181d3e61c52cb84ad819a4c8bf0b44cd91eb9653c1ca225cf36869178b87e8cbe6c7c6b9a7a3cf83b14cb207e4f85d95662285d8c929b65f069843c58fd

Download Submit
memory/1028-77-0x0000000001B50000-0x0000000001B56000-memory.dmp

Filesize
24KB

Download
memory/1028-76-0x0000000000060000-0x0000000000066000-memory.dmp

Filesize
24KB

Download
memory/1096-71-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-55-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-74-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-73-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-72-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-65-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-38-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-48-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-40-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-44-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-66-0x0000000000410000-0x0000000000430000-memory.dmp

Filesize
128KB

Download
memory/1096-62-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

Filesize
4KB

Download
memory/1096-60-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-58-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-56-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-67-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-52-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-50-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-46-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-63-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-42-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-70-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-68-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1096-69-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2408-17-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2408-16-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2408-18-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2408-7-0x0000000000850000-0x000000000086A000-memory.dmp

Filesize
104KB

Download
memory/2520-0-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

Filesize
4KB

Download
memory/2520-1-0x0000000000060000-0x00000000002CE000-memory.dmp

Filesize
2.4MB

Download
memory/2736-20-0x000000001B4E0000-0x000000001B700000-memory.dmp

Filesize
2.1MB

Download
memory/2736-19-0x00000000001F0000-0x0000000000410000-memory.dmp

Filesize
2.1MB

Download