xmrig | 6da5cd2f797bd2f7dbaadba3d332f986bcd7462e844093fc80642e457e2ae161

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
Size

9.0MB
MD5

be6b6e027032475d9803d34e0a41a956
SHA1

7f04a35dc8c3db0a683d71ae8edde8d3ed583e65
SHA256

d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7
SHA512

fd4d399caa663eaaebd73bdc79071dddd7e66913b084c2d4e1b989743383b86e1e89d109ef43a929c55ad65824d62ebecd2320d878a277727521c1cdbc8f8df4
SSDEEP

196608:bnK5xpo5NflpgSy6CkhJEtYBAmg9/1+U1/rekiA5ldBY4vaOM:bapo5NflpgSTLJEYhQ/1+U9LHdqr

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/1188-54-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-60-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-69-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-66-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-64-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-62-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-58-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-56-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-52-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-50-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-73-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-74-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-76-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-75-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-72-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-70-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1188-77-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig

Executes dropped EXE 2 IoCs

pid	Process
2676	umciavi32.exe
1728	sihost64.exe

Loads dropped DLL 4 IoCs

pid	Process
2736	cmd.exe
2736	cmd.exe
2676	umciavi32.exe
2676	umciavi32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
2676	umciavi32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2676 set thread context of 1188	2676	umciavi32.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
2676	umciavi32.exe
2676	umciavi32.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
Token: SeDebugPrivilege	2676	umciavi32.exe
Token: SeLockMemoryPrivilege	1188	svchost.exe
Token: SeLockMemoryPrivilege	1188	svchost.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2832	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	32
PID 2236 wrote to memory of 2832	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	32
PID 2236 wrote to memory of 2832	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	32
PID 2832 wrote to memory of 2704	2832	cmd.exe	34
PID 2832 wrote to memory of 2704	2832	cmd.exe	34
PID 2832 wrote to memory of 2704	2832	cmd.exe	34
PID 2236 wrote to memory of 2736	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	35
PID 2236 wrote to memory of 2736	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	35
PID 2236 wrote to memory of 2736	2236	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	35
PID 2736 wrote to memory of 2676	2736	cmd.exe	37
PID 2736 wrote to memory of 2676	2736	cmd.exe	37
PID 2736 wrote to memory of 2676	2736	cmd.exe	37
PID 2676 wrote to memory of 1728	2676	umciavi32.exe	38
PID 2676 wrote to memory of 1728	2676	umciavi32.exe	38
PID 2676 wrote to memory of 1728	2676	umciavi32.exe	38
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 2676 wrote to memory of 1188	2676	umciavi32.exe	39
PID 1728 wrote to memory of 1716	1728	sihost64.exe	40
PID 1728 wrote to memory of 1716	1728	sihost64.exe	40
PID 1728 wrote to memory of 1716	1728	sihost64.exe	40
PID 1728 wrote to memory of 1716	1728	sihost64.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
"C:\Users\Admin\AppData\Local\Temp\d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "umciavi32" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "umciavi32" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2704
- C:\Windows\system32\cmd.exe
  "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "gackyfnjrch"
        5⤵
        
        PID:1716
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe jfaxysvkq0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRSWr9mZW0WjQ8Zp6uvmLE6u5mJa6blLxbhLUBAH2hxKYIV+zuRDwuUBi5OrPMu66gPyw7gxP8IX80VPq/BMGCIFBkTOMbCf3MJ/sPlS5VXAPrlcMOalvFyeIXHIDtUbqKV18Jhqwg+UxjGvyu2oNdg+qXlBfLMdPaOjIDO+J7ZkJNdBoU4eCf0R5k6cBO8/Mimmk9lMvLnq+gG3iENLugY8qxVC1HSOWjmuo3WXFnRjj1i7g/1uZfrD/5WY21Xh4kB+F9A5wJKZoDeVOS+aDg9+Y0c+p+ahbp/yNqj7HecVMJm8e26JZ5iRWwVTuqNlLy9mObCCHUkAmh6zRw1XJgG78fbLuAx0Vhwzfn4UxmZM5snsrNY7eU15qfGDbB3HA/dpeX6tHT6AcPhPJheqyMc
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe

Filesize
9.0MB

MD5
be6b6e027032475d9803d34e0a41a956

SHA1
7f04a35dc8c3db0a683d71ae8edde8d3ed583e65

SHA256
d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7

SHA512
fd4d399caa663eaaebd73bdc79071dddd7e66913b084c2d4e1b989743383b86e1e89d109ef43a929c55ad65824d62ebecd2320d878a277727521c1cdbc8f8df4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe

Filesize
39KB

MD5
a51aa03902d0f874b358220ce4379d33

SHA1
e5116855bb8b230b7c5a5269ab190b1cb5217be9

SHA256
f65949d73f8147bdefc048e23d32e15f1a41e583bb622abb1ba25a712018a309

SHA512
e738698735c274968686884d0b6ec867d3faa84bcc5454855b3e2bacd7cb0d39ed7a2ca0b87f9e3914ef01a868030521f5e69e2814ed95bc9bebb49e35397e12

Download Submit
memory/1188-74-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-75-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-56-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-58-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-77-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-70-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-44-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-46-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-72-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-64-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-68-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/1188-52-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-76-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-73-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-54-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-60-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-71-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/1188-69-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-48-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-66-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-50-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1188-62-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1716-79-0x0000000000060000-0x0000000000067000-memory.dmp

Filesize
28KB

Download
memory/1716-80-0x0000000001C60000-0x0000000001C66000-memory.dmp

Filesize
24KB

Download
memory/2236-5-0x0000000077610000-0x0000000077612000-memory.dmp

Filesize
8KB

Download
memory/2236-15-0x000000001D560000-0x000000001D966000-memory.dmp

Filesize
4.0MB

Download
memory/2236-11-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/2236-1-0x0000000077610000-0x0000000077612000-memory.dmp

Filesize
8KB

Download
memory/2236-0-0x0000000000962000-0x0000000000C7F000-memory.dmp

Filesize
3.1MB

Download
memory/2236-10-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/2236-22-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/2236-17-0x0000000000962000-0x0000000000C7F000-memory.dmp

Filesize
3.1MB

Download
memory/2236-14-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/2236-13-0x0000000000962000-0x0000000000C7F000-memory.dmp

Filesize
3.1MB

Download
memory/2236-3-0x0000000077610000-0x0000000077612000-memory.dmp

Filesize
8KB

Download
memory/2236-6-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/2236-8-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/2676-33-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download