xmrig | 346cc7566192198b4cccfbcf75a083fbc8702ed576ca9e38c734dd4ca5a0a670

Analysis

max time kernel
3600s
max time network
3606s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-11-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
Size

4.9MB
MD5

b55e6b477ca8940e725bbe11472c8de9
SHA1

e2907125b20872929513955928965d7dfdd677c0
SHA256

34a1af6f382d625751970df7b954184de8d15cc96218a99cd2fbbd31534c39b0
SHA512

da80e4c2741592059b7aa572d8c726acc2bb3325ca85413e7bc093759ca9d21cbd5c830e03fe9e49e73d6affee84da38c22c6a47452c7cb8d259fd66e359c0a9
SSDEEP

98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTk:B/n03MdR8DB0OU0Fp2CYubag

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1016-7-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-6-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-9-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-11-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-13-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-12-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-10-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-14-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-17-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-18-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-19-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-20-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-25-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-23-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral1/memory/1016-24-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Suspicious use of SetThreadContext 1 IoCs

Processes:

56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe

description pid process target process

PID 4940 set thread context of 1016 4940 56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe explorer.exe

description	pid	process	target process
PID 4940 set thread context of 1016	4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe	explorer.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1016-3-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-4-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-7-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-5-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-6-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-9-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-1-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-11-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-13-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-12-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-10-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-2-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-14-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-17-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-18-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-19-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-20-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-25-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-23-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral1/memory/1016-24-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-4c-88-2d-2e-2c	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-4c-88-2d-2e-2c\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-4c-88-2d-2e-2c\WpadDecisionTime = 5b8161d4973fdb01	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-4c-88-2d-2e-2c\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe

pid process

4940 56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe

pid	process
4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

explorer.exesvchost.exe

description	pid	process
Token: SeLockMemoryPrivilege	1016	explorer.exe
Token: SeLockMemoryPrivilege	1016	explorer.exe
Token: SeShutdownPrivilege	4072	svchost.exe
Token: SeCreatePagefilePrivilege	4072	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

explorer.exe

pid	process
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exe

pid	process
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe
1016	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe

description	pid	process	target process
PID 4940 wrote to memory of 1016	4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe	explorer.exe
PID 4940 wrote to memory of 1016	4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe	explorer.exe
PID 4940 wrote to memory of 1016	4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe	explorer.exe
PID 4940 wrote to memory of 1016	4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe	explorer.exe
PID 4940 wrote to memory of 1016	4940	56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
"C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-3-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-4-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-8-0x0000000000FD0000-0x0000000000FF0000-memory.dmp

Filesize
128KB

Download
memory/1016-7-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-5-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-6-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-9-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-1-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-11-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-13-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-12-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-10-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-2-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-14-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-16-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1016-17-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-18-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-19-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-20-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-21-0x0000000012FB0000-0x0000000012FD0000-memory.dmp

Filesize
128KB

Download
memory/1016-22-0x0000000012FB0000-0x0000000012FD0000-memory.dmp

Filesize
128KB

Download
memory/1016-25-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-23-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-24-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/1016-27-0x00000000132C0000-0x00000000132E0000-memory.dmp

Filesize
128KB

Download
memory/1016-28-0x00000000132E0000-0x0000000013300000-memory.dmp

Filesize
128KB

Download
memory/1016-29-0x00000000132C0000-0x00000000132E0000-memory.dmp

Filesize
128KB

Download
memory/1016-30-0x00000000132E0000-0x0000000013300000-memory.dmp

Filesize
128KB

Download