xmrig | 200857adb30be019a2c67416124d32d4b99c0017ae7f7599639d0274d08ad36d

Resubmissions

13/04/2025, 03:45

250413-ea2fzsyjt3 10

21/02/2025, 15:15

250221-sm3fpstpcv 10

Analysis

max time kernel
42s
max time network
48s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
13/04/2025, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f_002bd8.gz
Size

150KB
MD5

6eeb393fffede6b434fe73ff813749cd
SHA1

7d142b33689615f7b519fa8cf7de5e4ff4511068
SHA256

200857adb30be019a2c67416124d32d4b99c0017ae7f7599639d0274d08ad36d
SHA512

7c8e73cca89a00a2c8954a3c04f3011d9d495589a5505337c97bc563ec56d266fea8fd24594ec5fd4b99a011a9a848b37881e5092ddeb8036fae746d775fe656
SSDEEP

3072:dCndB2RmZ/NEeif7fcowYA1Hk67MskEdAC8Dxu6xzpcqlVf:dCa2/N5iTfcoid7zKC8DAjqlVf

Score

10^/10

xmrig miner

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000028298-1.dat	family_xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3916	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3916	7zFM.exe
Token: 35	3916	7zFM.exe
Token: SeSecurityPrivilege	3916	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3916	7zFM.exe
3916	7zFM.exe
3916	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3124	OpenWith.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\f_002bd8.gz"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zOC4FD4B87\f_002bd8

Filesize
507KB

MD5
1d7891fe040f0df950ae7f6f9d4d6f6c

SHA1
5bfd998b47227b23d6c743726c3ba0137d76d0c3

SHA256
95be778c6e0c42cb998b8b51b628a4aa990af659e5707bea8899f04daa50558a

SHA512
22e667b785f3a8e20fc14302efe1340cbf76b72eec11c95e6f1589c48df1960ce2a0d1cd84ab89cbb036c038ca5f3c861eecdec0981956ecaad752db6ab6f30a

Download Submit