xmrig | df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5

General

Target

df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
Size

1.8MB
MD5

51b2c61b9470cb0dfa49863e6fdba3aa
SHA1

1c0defb75af00bedc3322f3def8a9215180551f0
SHA256

df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5
SHA512

e64c28436295ae5b0428198e10227f11a26faafafefcd4375d1abb99d5bbbf93e0753be6f6ecce1b9745535690d083604ce5f756122f03df99f6ef949fa9ef65
SSDEEP

49152:3JypKilsPbk1o4W7BtN2vYeTgcImmvUEGh/KF:QpKilsJVzNYYeUjsEGhCF

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/3512-3-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3512-13-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3276-22-0x0000000000400000-0x0000000000582000-memory.dmp	xmrig
behavioral2/memory/3276-27-0x0000000025870000-0x0000000025A03000-memory.dmp	xmrig
behavioral2/memory/3276-29-0x0000000000400000-0x000000000057C000-memory.dmp	xmrig
behavioral2/memory/3276-28-0x0000000025B90000-0x0000000025D12000-memory.dmp	xmrig
behavioral2/memory/3276-38-0x0000000000400000-0x0000000000A7A000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3276	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

Executes dropped EXE 1 IoCs

pid	Process
3276	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3512-0-0x0000000000400000-0x0000000000A7A000-memory.dmp	upx
behavioral2/files/0x000b000000023b78-12.dat	upx
behavioral2/memory/3276-14-0x0000000000400000-0x0000000000A7A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3512	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3276	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
Token: SeLockMemoryPrivilege	3276	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3512	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
3276	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3276	3512	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe	84
PID 3512 wrote to memory of 3276	3512	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe	84
PID 3512 wrote to memory of 3276	3512	df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe	84

C:\Users\Admin\AppData\Local\Temp\df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
"C:\Users\Admin\AppData\Local\Temp\df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
  C:\Users\Admin\AppData\Local\Temp\df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\df5601d9d293b4efe0aac2981f75258b741e9e3e5fc2a5cffa1f649ff1ba9cb5.exe

Filesize
1.8MB

MD5
d2e40be51aed10d270ea7ae18b941155

SHA1
83570cb980bccea18931ae17fba6bfbf664eb95f

SHA256
b39edd984e3d83cb2c27881585fb14d27bfe0d1f4f52d44273b821bbb13cf02c

SHA512
0c60816b27d723fadb795c05fde8469d12b46f3da1ea98298c607c9bcc721916accc1f9a6bcfcd3dc1c6fbea50e7cd6a99077dbb1349beb687e4bed7c3e286c2

Download Submit
memory/3276-14-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/3276-15-0x0000000021E90000-0x000000002202E000-memory.dmp

Filesize
1.6MB

Download
memory/3276-22-0x0000000000400000-0x0000000000582000-memory.dmp

Filesize
1.5MB

Download
memory/3276-27-0x0000000025870000-0x0000000025A03000-memory.dmp

Filesize
1.6MB

Download
memory/3276-29-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/3276-28-0x0000000025B90000-0x0000000025D12000-memory.dmp

Filesize
1.5MB

Download
memory/3276-38-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/3512-0-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/3512-1-0x0000000021E70000-0x000000002200E000-memory.dmp

Filesize
1.6MB

Download
memory/3512-3-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3512-13-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing