xmrig | 3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52

General

Target

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
Size

1.3MB
MD5

d67579b6e5b3a9c10ae130fb475f27ce
SHA1

b45953bade2749aeb93594a492fd7cfa183f2c42
SHA256

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52
SHA512

b82c3b7da42e2f0e5500439c88f74bdc152da849f6dda9ff7a58565358a9ca8e1d2f9fd74ff7d322d741c5af0df80784ee4ed4409f3b0f06ee511ab99c7e702a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7N4b:Lz071uv4BPMkibTIA5JnJ1y

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5116-33-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-156-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-240-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-241-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-245-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-246-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-247-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-248-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-249-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-250-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-251-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig
behavioral2/memory/5116-252-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exe

flow	pid	Process
9	2912	powershell.exe
11	2912	powershell.exe
21	2912	powershell.exe
22	2912	powershell.exe
24	2912	powershell.exe
26	2912	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2912	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5116-0-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-33-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-156-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-240-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-241-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-245-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-246-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-247-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-248-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-249-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-250-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-251-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx
behavioral2/memory/5116-252-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid	Process
2912	powershell.exe
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exepowershell.exe

description	pid	Process
Token: SeLockMemoryPrivilege	5116	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeLockMemoryPrivilege	5116	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe

description	pid	Process	procid_target
PID 5116 wrote to memory of 2912	5116	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe	84
PID 5116 wrote to memory of 2912	5116	3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe	84

C:\Users\Admin\AppData\Local\Temp\3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe
"C:\Users\Admin\AppData\Local\Temp\3ea06f03a74f0f7443376fb35555171c4656912ece517ca8e2d3a5893b867c52.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wopufnd1.nyz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2912-238-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/2912-244-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/2912-2-0x00007FFC0D293000-0x00007FFC0D295000-memory.dmp

Filesize
8KB

Download
memory/2912-8-0x00000211D8FF0000-0x00000211D9012000-memory.dmp

Filesize
136KB

Download
memory/2912-13-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/2912-14-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/2912-15-0x00000211D9C90000-0x00000211DA436000-memory.dmp

Filesize
7.6MB

Download
memory/2912-17-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/2912-239-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/2912-61-0x00007FFC0D293000-0x00007FFC0D295000-memory.dmp

Filesize
8KB

Download
memory/2912-62-0x00007FFC0D290000-0x00007FFC0DD51000-memory.dmp

Filesize
10.8MB

Download
memory/5116-156-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-246-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-33-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-240-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-241-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-1-0x0000018B96120000-0x0000018B96130000-memory.dmp

Filesize
64KB

Download
memory/5116-245-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-0-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-247-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-248-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-249-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-250-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-251-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download
memory/5116-252-0x00007FF7FCA90000-0x00007FF7FCE82000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads