xmrig | 53b37a734ab27bb40626c6434029defbebe8470f2d89b97e7ce85b40c9a3b05f | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 00:17

Sharing

Report Analysis Logs

General

Target

xmrig-6.22.2/rtm_ghostrider_example.cmd
Size

1KB
MD5

3f0155abe745be1f6089eafc4f517ac8
SHA1

277f510ceb62b277b141d094c82eedebdc6f3a35
SHA256

810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344
SHA512

8def46852a962ff5dbed94e01f8d23019ef401a718d9c5a440d12b2ffa369539be328f165f68ccc2098cd5e5c939bcb5f784f877bdd7b9d939393bbd2229d19e

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

resource	yara_rule
behavioral9/memory/1212-0-0x000000013FF80000-0x0000000140BB4000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1212	2080	cmd.exe	31
PID 2080 wrote to memory of 1212	2080	cmd.exe	31
PID 2080 wrote to memory of 1212	2080	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2\rtm_ghostrider_example.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.2\xmrig.exe
  xmrig.exe -a gr -o raptoreumemporium.com:3008 -u WALLET_ADDRESS -p x
  2⤵
  PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-0-0x000000013FF80000-0x0000000140BB4000-memory.dmp

Filesize
12.2MB

Download