xmrig | 82ef3dff1d3e75ba34a936e74f349f8a48ed91b0210e713a59596934a8718e98

General

Target

3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe
Size

2.6MB
MD5

494cc0e2a4aa4fe252099c1499a5fd4e
SHA1

4c8cc67beebc0e9f015ae3113957aab4dbf1285f
SHA256

3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6
SHA512

dc4567e49456976f778d2da6561d15d764519c71424ce8038ece137c5c50794a8d056674fce4ee810ef46d6558a12835ecc24aaa123d6ef4184515e4ef737a58
SSDEEP

49152:lt6NLonrxnS/+Dwr/5UeLFeEhsG89y+6rxvVsveHZMlJ8eH4elKpGOyUw:lIyxv2/2Eu9y+gsveHZM8exmyUw

Score

10^/10

xmrig evasion execution miner persistence upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2384-10-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-14-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-16-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-15-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-13-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-11-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-17-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-18-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2384-19-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
480	Process not Found
2732	Any Desk

Loads dropped DLL 1 IoCs

pid	Process
480	Process not Found

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 2384	2732	Any Desk	40

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-5-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-6-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-7-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-8-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-10-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-9-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-14-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-16-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-15-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-13-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-11-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-17-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-18-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2384-19-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2336	sc.exe
1964	sc.exe
1020	sc.exe
2416	sc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2460	3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe
2460	3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe
2460	3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe
2460	3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe
2732	Any Desk

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2384	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2384	2732	Any Desk	40
PID 2732 wrote to memory of 2384	2732	Any Desk	40
PID 2732 wrote to memory of 2384	2732	Any Desk	40
PID 2732 wrote to memory of 2384	2732	Any Desk	40
PID 2732 wrote to memory of 2384	2732	Any Desk	40

C:\Users\Admin\AppData\Local\Temp\3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe
"C:\Users\Admin\AppData\Local\Temp\3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "Any Desk"
  2⤵
  - Launches sc.exe
  PID:2336
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "Any Desk" binpath= "C:\ProgramData\Any Desk" start= "auto"
  2⤵
  - Launches sc.exe
  PID:1964
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:1020
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "Any Desk"
  2⤵
  - Launches sc.exe
  PID:2416

C:\ProgramData\Any Desk
"C:\ProgramData\Any Desk"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Any Desk

Filesize
2.6MB

MD5
494cc0e2a4aa4fe252099c1499a5fd4e

SHA1
4c8cc67beebc0e9f015ae3113957aab4dbf1285f

SHA256
3e4dd2a19e5c08068bfb5c980732ff696a0e950b4bc6f0efe6e7e47a567793d6

SHA512
dc4567e49456976f778d2da6561d15d764519c71424ce8038ece137c5c50794a8d056674fce4ee810ef46d6558a12835ecc24aaa123d6ef4184515e4ef737a58

Download Submit
memory/2384-5-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-6-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-7-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-8-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-10-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-12-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/2384-9-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-14-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-16-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-15-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-13-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-11-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-17-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-18-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-19-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-20-0x00000000007A0000-0x00000000007C0000-memory.dmp

Filesize
128KB

Download
memory/2384-21-0x00000000007A0000-0x00000000007C0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing