xmrig | 6da5cd2f797bd2f7dbaadba3d332f986bcd7462e844093fc80642e457e2ae161

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
Size

9.0MB
MD5

be6b6e027032475d9803d34e0a41a956
SHA1

7f04a35dc8c3db0a683d71ae8edde8d3ed583e65
SHA256

d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7
SHA512

fd4d399caa663eaaebd73bdc79071dddd7e66913b084c2d4e1b989743383b86e1e89d109ef43a929c55ad65824d62ebecd2320d878a277727521c1cdbc8f8df4
SSDEEP

196608:bnK5xpo5NflpgSy6CkhJEtYBAmg9/1+U1/rekiA5ldBY4vaOM:bapo5NflpgSTLJEYhQ/1+U9LHdqr

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral2/memory/1884-29-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-31-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-34-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-37-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-36-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-35-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-33-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-38-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-40-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-41-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral2/memory/1884-44-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	umciavi32.exe

Executes dropped EXE 2 IoCs

pid	Process
1044	umciavi32.exe
4492	sihost64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
1044	umciavi32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 1884	1044	umciavi32.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
1044	umciavi32.exe
1044	umciavi32.exe
1044	umciavi32.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe
1884	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
Token: SeDebugPrivilege	1044	umciavi32.exe
Token: SeLockMemoryPrivilege	1884	svchost.exe
Token: SeLockMemoryPrivilege	1884	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 920	4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	99
PID 4648 wrote to memory of 920	4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	99
PID 920 wrote to memory of 3664	920	cmd.exe	101
PID 920 wrote to memory of 3664	920	cmd.exe	101
PID 4648 wrote to memory of 536	4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	102
PID 4648 wrote to memory of 536	4648	d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe	102
PID 536 wrote to memory of 1044	536	cmd.exe	104
PID 536 wrote to memory of 1044	536	cmd.exe	104
PID 1044 wrote to memory of 4492	1044	umciavi32.exe	106
PID 1044 wrote to memory of 4492	1044	umciavi32.exe	106
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 1044 wrote to memory of 1884	1044	umciavi32.exe	107
PID 4492 wrote to memory of 224	4492	sihost64.exe	109
PID 4492 wrote to memory of 224	4492	sihost64.exe	109
PID 4492 wrote to memory of 224	4492	sihost64.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe
"C:\Users\Admin\AppData\Local\Temp\d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "umciavi32" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "umciavi32" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3664
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "gackyfnjrch"
        5⤵
        
        PID:224
  - - C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe jfaxysvkq0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRSWr9mZW0WjQ8Zp6uvmLE6u5mJa6blLxbhLUBAH2hxKYIV+zuRDwuUBi5OrPMu66gPyw7gxP8IX80VPq/BMGCIFBkTOMbCf3MJ/sPlS5VXAPrlcMOalvFyeIXHIDtUbqKV18Jhqwg+UxjGvyu2oNdg+qXlBfLMdPaOjIDO+J7ZkJNdBoU4eCf0R5k6cBO8/Mimmk9lMvLnq+gG3iENLugY8qxVC1HSOWjmuo3WXFnRjj1i7g/1uZfrD/5WY21Xh4kB+F9A5wJKZoDeVOS+aDg9+Y0c+p+ahbp/yNqj7HecVMJm8e26JZ5iRWwVTuqNlLy9mObCCHUkAmh6zRw1XJgG78fbLuAx0Vhwzfn4UxmZM5snsrNY7eU15qfGDbB3HA/dpeX6tHT6AcPhPJheqyMc
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe

Filesize
39KB

MD5
a51aa03902d0f874b358220ce4379d33

SHA1
e5116855bb8b230b7c5a5269ab190b1cb5217be9

SHA256
f65949d73f8147bdefc048e23d32e15f1a41e583bb622abb1ba25a712018a309

SHA512
e738698735c274968686884d0b6ec867d3faa84bcc5454855b3e2bacd7cb0d39ed7a2ca0b87f9e3914ef01a868030521f5e69e2814ed95bc9bebb49e35397e12

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\umciavi32.exe

Filesize
9.0MB

MD5
be6b6e027032475d9803d34e0a41a956

SHA1
7f04a35dc8c3db0a683d71ae8edde8d3ed583e65

SHA256
d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7

SHA512
fd4d399caa663eaaebd73bdc79071dddd7e66913b084c2d4e1b989743383b86e1e89d109ef43a929c55ad65824d62ebecd2320d878a277727521c1cdbc8f8df4

Download Submit
memory/224-43-0x00000287421C0000-0x00000287421C6000-memory.dmp

Filesize
24KB

Download
memory/224-42-0x0000028741E60000-0x0000028741E67000-memory.dmp

Filesize
28KB

Download
memory/1044-18-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/1884-36-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-38-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-44-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-41-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-40-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-33-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-35-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-37-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-29-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-32-0x000001AC363D0000-0x000001AC363F0000-memory.dmp

Filesize
128KB

Download
memory/1884-31-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1884-34-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/4648-3-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/4648-0-0x0000000000962000-0x0000000000C7F000-memory.dmp

Filesize
3.1MB

Download
memory/4648-5-0x0000000000962000-0x0000000000C7F000-memory.dmp

Filesize
3.1MB

Download
memory/4648-6-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/4648-7-0x000000001D3C0000-0x000000001D7C6000-memory.dmp

Filesize
4.0MB

Download
memory/4648-12-0x0000000000400000-0x0000000001565000-memory.dmp

Filesize
17.4MB

Download
memory/4648-11-0x0000000000962000-0x0000000000C7F000-memory.dmp

Filesize
3.1MB

Download
memory/4648-1-0x00007FF927A10000-0x00007FF927A12000-memory.dmp

Filesize
8KB

Download
memory/4648-2-0x00007FF927A20000-0x00007FF927A22000-memory.dmp

Filesize
8KB

Download
memory/4648-8-0x00000000032E0000-0x00000000032F2000-memory.dmp

Filesize
72KB

Download