xmrig | 81ce9c06e8f78145ab79a7f369da4e6c9d1dcb65bfb9def56b677f27e7ad85ea

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe
Size

784KB
MD5

ffeca026a865c97a0c9a8a9010f8f52a
SHA1

bfb3796c496fbc0b508d2e4cbadac706432f5c5e
SHA256

81ce9c06e8f78145ab79a7f369da4e6c9d1dcb65bfb9def56b677f27e7ad85ea
SHA512

fb2a8ec8434135f0da86a7dc539dc458aa77ac4c7ae85774cb516a3fb662daaeda8bdd9e383765ae154c3886fc1251623e845a45ec00ee689ffac04772852a8c
SSDEEP

24576:MHDuTk3o0Tjv1G3goIbs59t5RvB/FiUQbsIWEMa:MjuTqnUwoKsB55pFiUeBWEM

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4928-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4928-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1880-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1880-29-0x0000000005450000-0x00000000055E3000-memory.dmp	xmrig
behavioral2/memory/1880-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1880-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1880	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1880	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x000c000000023b79-11.dat	upx
behavioral2/memory/1880-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4928	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4928	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe
1880	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1880	4928	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe	83
PID 4928 wrote to memory of 1880	4928	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe	83
PID 4928 wrote to memory of 1880	4928	ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ffeca026a865c97a0c9a8a9010f8f52a_JaffaCakes118.exe

Filesize
784KB

MD5
d6c93b0b1d5786d92c2a02e32363e5df

SHA1
3f9303176fded8c446cbdad7b8d4859688ad0bd2

SHA256
98d65973ad721c74e63e593200d9ec03a8cccecbd374d83ed1bfb9d172d48cf6

SHA512
054dd918c6d6636d79182cf01d2f09da82909b9c73bd3715fcc97883164911d1a75dbf7a4698ffb6d71a4d6d32e193951df885d0ad1622ef3c3ef30588232a3f

Download Submit
memory/1880-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1880-14-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/1880-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1880-29-0x0000000005450000-0x00000000055E3000-memory.dmp

Filesize
1.6MB

Download
memory/1880-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1880-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/4928-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/4928-1-0x0000000001A10000-0x0000000001AD4000-memory.dmp

Filesize
784KB

Download
memory/4928-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4928-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download