xmrig | 635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e

General

Target

635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe
Size

1.9MB
MD5

b491f21e9d8964b3118b6100676cf0cc
SHA1

9a074f01f0775dfb4e66cc6752614903b2637481
SHA256

635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e
SHA512

80bd1e09a03af97b35da108e7011d75f931f19f14d465ff77229725ef9ff0771e5b7fc2fa075d767ed85bc232ac84a6f7b57b07769c0d921e071905dbeecf49c
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCB2lU2:NABp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2104-15-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-16-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-17-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-18-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-19-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-20-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-21-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-22-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-23-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-24-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-25-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2104-26-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2504 powershell.exe

pid	process
2504	powershell.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2104-1-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-15-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-16-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-17-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-18-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-19-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-20-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-21-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-22-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-23-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-24-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-25-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2104-26-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2504 powershell.exe

pid	process
2504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2104	635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe
Token: SeLockMemoryPrivilege	2104	635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe
Token: SeDebugPrivilege	2504	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe

description	pid	process	target process
PID 2104 wrote to memory of 2504	2104	635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe	powershell.exe
PID 2104 wrote to memory of 2504	2104	635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe	powershell.exe
PID 2104 wrote to memory of 2504	2104	635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe
"C:\Users\Admin\AppData\Local\Temp\635a1fa6be24e24ae11cd67152f224b97d05fe6afa39ab4dc14442b74666a42e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-23-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-18-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-26-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-25-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-24-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2104-1-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-22-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-19-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-20-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-21-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-15-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-16-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-17-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-8-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2504-14-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-13-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-12-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-11-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-10-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-9-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2504-7-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2504-6-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads