xmrig | 346cc7566192198b4cccfbcf75a083fbc8702ed576ca9e38c734dd4ca5a0a670

Analysis

max time kernel
3599s
max time network
3598s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-11-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe
Size

4.9MB
MD5

5b074df339cb192286169805c8432c77
SHA1

9ecfe398cebec265c70f7d32ba1ec66c60ac1185
SHA256

647675cfe31d35d77be0d34542c489db46f7d9f75fb1e30908e93975ed3ec43c
SHA512

09518e716d279177bed8ddea951ac2d2f0e24a928a35f07cb0fcf9cb5956c7d9ab343494c0815b8004c102a1069a60abc679cd693dfb60457ef84e0d6e97aa33
SSDEEP

98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTH:B/n03MdR8DB0OU0Fp2CYubaL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

Processes:

resource	yara_rule
behavioral14/memory/4000-6-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-7-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-11-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-10-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-12-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-9-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-13-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-14-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-17-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-18-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-19-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-20-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-23-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-24-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig
behavioral14/memory/4000-25-0x0000000140000000-0x0000000140835000-memory.dmp	xmrig

Suspicious use of SetThreadContext 1 IoCs

Processes:

bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe

description pid process target process

PID 1480 set thread context of 4000 1480 bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe explorer.exe

description	pid	process	target process
PID 1480 set thread context of 4000	1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe	explorer.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral14/memory/4000-3-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-2-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-6-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-7-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-11-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-10-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-12-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-9-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-5-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-4-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-13-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-1-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-14-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-17-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-18-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-19-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-20-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-23-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-24-0x0000000140000000-0x0000000140835000-memory.dmp	upx
behavioral14/memory/4000-25-0x0000000140000000-0x0000000140835000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-49-74-7f-62-9c	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-49-74-7f-62-9c\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-49-74-7f-62-9c\WpadDecisionTime = a8a94bdf973fdb01	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-49-74-7f-62-9c\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe

pid process

1480 bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe

pid	process
1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

explorer.exesvchost.exe

description	pid	process
Token: SeLockMemoryPrivilege	4000	explorer.exe
Token: SeLockMemoryPrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	1396	svchost.exe
Token: SeCreatePagefilePrivilege	1396	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

explorer.exe

pid	process
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exe

pid	process
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe
4000	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe

description	pid	process	target process
PID 1480 wrote to memory of 4000	1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe	explorer.exe
PID 1480 wrote to memory of 4000	1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe	explorer.exe
PID 1480 wrote to memory of 4000	1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe	explorer.exe
PID 1480 wrote to memory of 4000	1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe	explorer.exe
PID 1480 wrote to memory of 4000	1480	bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe
"C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4000-3-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-2-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-6-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-7-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-11-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-10-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-12-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-9-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-5-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-8-0x00000000007C0000-0x00000000007E0000-memory.dmp

Filesize
128KB

Download
memory/4000-4-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-13-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-1-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-14-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-16-0x0000000012960000-0x0000000012980000-memory.dmp

Filesize
128KB

Download
memory/4000-17-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-18-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-19-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-20-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-21-0x0000000012CB0000-0x0000000012CD0000-memory.dmp

Filesize
128KB

Download
memory/4000-22-0x0000000012CB0000-0x0000000012CD0000-memory.dmp

Filesize
128KB

Download
memory/4000-23-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-24-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-25-0x0000000140000000-0x0000000140835000-memory.dmp

Filesize
8.2MB

Download
memory/4000-27-0x0000000012FC0000-0x0000000012FE0000-memory.dmp

Filesize
128KB

Download
memory/4000-28-0x0000000012FE0000-0x0000000013000000-memory.dmp

Filesize
128KB

Download
memory/4000-29-0x0000000012FC0000-0x0000000012FE0000-memory.dmp

Filesize
128KB

Download
memory/4000-30-0x0000000012FE0000-0x0000000013000000-memory.dmp

Filesize
128KB

Download