xmrig | 3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52

General

Target

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
Size

1.3MB
MD5

d67579b6e5b3a9c10ae130fb475f27ce
SHA1

b45953bade2749aeb93594a492fd7cfa183f2c42
SHA256

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52
SHA512

b82c3b7da42e2f0e5500439c88f74bdc152da849f6dda9ff7a58565358a9ca8e1d2f9fd74ff7d322d741c5af0df80784ee4ed4409f3b0f06ee511ab99c7e702a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7N4b:Lz071uv4BPMkibTIA5JnJ1y

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2292-15-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-16-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-17-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-18-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-19-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-20-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-21-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-22-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-23-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-24-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-25-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2292-26-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2064	powershell.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2292-0-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-15-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-16-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-17-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-18-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-19-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-20-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-21-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-22-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-23-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-24-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-25-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2292-26-0x000000013F860000-0x000000013FC52000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2064	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exepowershell.exe

description	pid	Process
Token: SeLockMemoryPrivilege	2292	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
Token: SeLockMemoryPrivilege	2292	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe

description	pid	Process	procid_target
PID 2292 wrote to memory of 2064	2292	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe	29
PID 2292 wrote to memory of 2064	2292	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe	29
PID 2292 wrote to memory of 2064	2292	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe	29

C:\Users\Admin\AppData\Local\Temp\3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
"C:\Users\Admin\AppData\Local\Temp\3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-14-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-6-0x000007FEF58FE000-0x000007FEF58FF000-memory.dmp

Filesize
4KB

Download
memory/2064-13-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-7-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/2064-9-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-8-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2064-10-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-12-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-11-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download
memory/2292-26-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-20-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2292-0-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-17-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-18-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-19-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-16-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-21-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-22-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-23-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-24-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-25-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2292-15-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads