xmrig | 53b37a734ab27bb40626c6434029defbebe8470f2d89b97e7ce85b40c9a3b05f | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 00:17

Sharing

Report Analysis Logs

General

Target

xmrig-6.22.2/benchmark_10M.cmd
Size

61B
MD5

5be1c4cacb5ae37c43527e99a097dc7a
SHA1

1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
SHA256

235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
SHA512

20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

resource	yara_rule
behavioral3/memory/2552-0-0x000000013FC10000-0x0000000140844000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2552	2304	cmd.exe	32
PID 2304 wrote to memory of 2552	2304	cmd.exe	32
PID 2304 wrote to memory of 2552	2304	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2\benchmark_10M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2\xmrig.exe
  xmrig.exe --bench=10M --submit
  2⤵
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x000000013FC10000-0x0000000140844000-memory.dmp

Filesize
12.2MB

Download