xmrig | 462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4

Analysis

max time kernel
110s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 03:13

Target

462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4.exe
Size

988KB
MD5

17c124b910eb253376e60f8240dbf4be
SHA1

7a3745a5fc4076d4f73ab07927eec133aec5e2b7
SHA256

462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4
SHA512

a1bac803d994d5f993b103b3134aa4c488ab54a95355ff12ae1db11e08510a7839a845efb1ed57888a37e825823ec1262492a378f887c2d76530dc0196719c38
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DF1:knw9oUUEEDl37jcmWHP

Score

10^/10

xmrig miner upx

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1640-3-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-2-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-4-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-5-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-6-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-7-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-8-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-9-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-10-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-11-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-12-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig
behavioral2/memory/1640-13-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	xmrig

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1640-0-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-3-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-2-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-4-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-5-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-6-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-7-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-8-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-9-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-10-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-11-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-12-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx
behavioral2/memory/1640-13-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4.exe

description	pid	Process
Token: SeLockMemoryPrivilege	1640	462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4.exe
Token: SeLockMemoryPrivilege	1640	462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4.exe

C:\Users\Admin\AppData\Local\Temp\462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4.exe
"C:\Users\Admin\AppData\Local\Temp\462f435bc5607e0a683822dca20b39e0fdcfaed3e049ee70be350a7009abefe4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

memory/1640-0-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-1-0x000002A74C240000-0x000002A74C250000-memory.dmp

Filesize
64KB

Download
memory/1640-3-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-4-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-5-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-6-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-7-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-8-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-9-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-10-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-11-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-12-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download
memory/1640-13-0x00007FF7C78B0000-0x00007FF7C7CA1000-memory.dmp

Filesize
3.9MB

Download