xmrig | 3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe
Size

1.0MB
MD5

b68c0ca1c018172f296099f52ce56717
SHA1

60e0caae92c3ff0770e821b90922802f25db6a19
SHA256

3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a
SHA512

973666e9b18ef402e0e0d3ce690c88096274677c7d082f0ce891b26b2136141d62f71231d00adfc808d54096816b4afe0f4127f23e26f7b113a13edaec940b48
SSDEEP

24576:EnCbLE/tyK3yt0mFdfE0bLBgDOph4THCGLQTfwlKjoIdBF672X:EnCbL83y9FdfE0pZ0zCa4wI1b

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral1/memory/2104-0-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/files/0x000d000000012281-5.dat	xmrig
behavioral1/memory/2284-7-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig
behavioral1/memory/2104-8-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/memory/2284-10-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
2284	jbLAzGM.exe

Loads dropped DLL 1 IoCs

pid	Process
2104	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-0-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/files/0x000d000000012281-5.dat	upx
behavioral1/memory/2284-7-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx
behavioral1/memory/2104-8-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/memory/2284-10-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System\jbLAzGM.exe	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2104	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe
Token: SeLockMemoryPrivilege	2104	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2284	2104	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe	31
PID 2104 wrote to memory of 2284	2104	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe	31
PID 2104 wrote to memory of 2284	2104	JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3efe9cae4de6334d83879d45eeebea853855f3f3109359867f8ed03f27b1788a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System\jbLAzGM.exe
  C:\Windows\System\jbLAzGM.exe
  2⤵
  - Executes dropped EXE
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\jbLAzGM.exe

Filesize
1.0MB

MD5
093fd89dfde829469dd0b26354ccb4b8

SHA1
7bfa97bd391c8d80f90b6b827efe043122b53eb0

SHA256
15ce14a9ad94cf9f3f3df18d79f6ff0a53004e86a066c19626ccdbdbfb166289

SHA512
2f89637f122bf5a66e78220b7689c08c3df2e14ab51335ffcc072e6d32c6d74ade3f5a961268e07bacc880d4f5212b84dbc860e04edd91d102732577b7136eef

Download Submit
memory/2104-0-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2104-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2104-8-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2104-9-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/2284-7-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/2284-10-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download