xmrig | 03d8d8b76fcc2d18e3d4db247974257e4b3c939cec76235eee02410f6c30e7fc

General

Target
Gosth.exe
Size 13.1MB
Sample260913-styfbsyenb
SHA256 03d8d8b76fcc2d18e3d4db247974257e4b3c939cec76235eee02410f6c30e7fc
MD5 5c3ea987247d49d672db7c4e9bbfaae1
SHA1 8e9072d6922ae38249c2567d209105a8402c2908
SHA512 3f2de202c80257e54c9c48e0c845365b77303f1050bce9c2e36778a1acedea4279df8a7f1f825ae3116dcc90b2042387d2be8a02953ce82c9e7aa19f895b6b39
SSDEEP 393216:GrAQFb2AsPyQtozj7d5Rg7bFdbqLrkf5B1YN9:GrpCAsPKfr+FdmLrg70
TLSH
T157D633F6C9308297CD57C5770F621A74349269AA268863D38B1B32A197143CEF8BD17F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral3/files/0x001900000002b47d-21.dat	family_xmrig_powershell_dropper

Executes dropped EXE 5 IoCs

pid	Process
5320	Gosth.exe
4596	Miner.exe
2776	Loader.exe
1404	Launcher.exe
4908	miner.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1564	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miner.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	powershell.exe
1564	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	Loader.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	Loader.exe
Token: SeIncreaseQuotaPrivilege	2776	Loader.exe
Token: SeSecurityPrivilege	2776	Loader.exe
Token: SeTakeOwnershipPrivilege	2776	Loader.exe
Token: SeLoadDriverPrivilege	2776	Loader.exe
Token: SeTcbPrivilege	2776	Loader.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	Loader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 5320	5312	Gosth.exe	81
PID 5312 wrote to memory of 4596	5312	Gosth.exe	82
PID 5312 wrote to memory of 2776	5312	Gosth.exe	83
PID 4596 wrote to memory of 1404	4596	Miner.exe	84
PID 4596 wrote to memory of 4908	4596	Miner.exe	85
PID 4908 wrote to memory of 4176	4908	miner.exe	90
PID 4176 wrote to memory of 1564	4176	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\Gosth.exe
"C:\Users\Admin\AppData\Local\Temp\Gosth.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Gosth.exe
  "C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Gosth.exe"
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Miner.exe
  "C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Miner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\miner.exe
    "C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\miner.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\99DA.tmp\99DB.tmp\99DC.bat C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\miner.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "# ==============================================================================
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
- C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\Launcher.exe
Size 1.1MB
SHA256 a14a3fa38358fa0a6d09dc48d8d0957827b92adcb11f220d73e262777d8f414a
MD5 f3b39541326e063f298193febbd4840c
SHA1 d113df832f744ce082380c780162cacddef54da0
SHA512 34abda88bffc16eba848b64015dc74bc4024303ad02befba09f6de5d4b0bb394664483bfe42ed67af5cf4375aaf6c98fff107ee8c0c1bcc26765eacddba323c0
SSDEEP 12288:Tbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD/vfqItNqdg:TbOVE5ifGPRZwLvf3fd
TLSH
T150357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner.exe

Path C:\Users\Admin\AppData\Local\Temp\8ACFFD7B\miner.exe
Size 98KB
SHA256 1e016fa4754ff0e4c7d71dc6264b3565a5e20bd5421f92788621d53cdf9b3b32
MD5 4ba7e07265ac2e1b1b3b1814d4238d5f
SHA1 3e90502a351091aec855097b7921db30bdfa2043
SHA512 536fa4e28e16f319c752650721fbb367e789dfc9889a4cad05b15f4f09a0ce32c691497cd43510c25504965a089a36d351014315f92ecc4a4adaf27d679a05a9
SSDEEP 1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfnwavfCVKOu:/7DhdC6kzWypvaQ0FxyNTBfnnKg
TLSH
T108A38D41F3E202F7E6F2053100A6626FD73A62389724E8DBC75C2D529913AD5A63D3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99DC.bat

Path C:\Users\Admin\AppData\Local\Temp\99DA.tmp\99DB.tmp\99DC.bat
Size 9KB
SHA256 ba601ffbc70155e8af8a05b5a34c75da97f9710399d72290dd07d76a585d103f
MD5 8f8277b404b900acf6fdfbb262964aaa
SHA1 f45fe23628ecb393a9e69ab9eb536e6c553750bc
SHA512 b3267fcd8f1508c6e640b67efc10274b4bf15a1a7193f2dd78d70b6e1226437b43deb5a6df57c474cba01e8deffdaa18114b11ff4a5027be3a37b5bf0a136705
SSDEEP 192:nWP453YCrQij3AECxuC4DKxIH0gbtNBuo7JwX3sGPHCFiHhXSPkR:nWP4vQCsMXKiBNBRwxbBis
TLSH
T17912A415AA046326CABB6B1B8CC27305FD5B413B824B09C4B67CC154BFB4B9E8395CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gosth.exe

Path C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Gosth.exe
Size 2.7MB
SHA256 554b3b9dd270b74f018c6bc7ca7f45b65ea3616bcf3d00fae7df0691e7967f11
MD5 9371ac25e96d5592be828a26b1d45916
SHA1 8cc44ed58b1860c6e3b3ef9b556b55a3ed57fa3d
SHA512 c754f17fb2e70d4f9c90145f0256885b34ec5aaa0bbaeacd3c967f1a6a4a0ff4d0562cd45b544de7486bebea22701a73ce00d269b257c5bd75932e046e2f53d1
SSDEEP 49152:AoH0JoGiKmInMTRbM1fOT8+HE2a69AJRGFgu0VDaplvP:6UIMTJFAJYdplvP
TLSH
T1CFD5DF46A39642DCCA66D578C64B9B27E375780403308AEB6BD41F9A6F577E03A3F340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Loader.exe
Size 19.5MB
SHA256 7553d49cdc2387acb96a808a2aefaf22f59ab4528e0a7b36d5c13d07b6d91ff2
MD5 090261ad49ede6a1818453cc22dc899f
SHA1 07e986c416575fbfe76d6cf9bd04882658665711
SHA512 63cd47576c2781f7e06c6dfcfc45ba531c58bc5860b2ef0d72b288ca83ced428d9cff67be345e20a6798eecc8b97686404af23b87a654a1646287f2808e664cd
SSDEEP 393216:P7Cw2RxO6QIRRX8fCAXjJI1VmpKbVVVAHLYONri6DJ0+e1PtLicy08Xaa06M7APW:rHUIn/3+
TLSH
T15827D017F3955168D073E138CA638B0AF7317426072246DB779C0A686FBB3E44BBA791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Miner.exe

Path C:\Users\Admin\AppData\Local\Temp\C59FFD7B\Miner.exe
Size 332KB
SHA256 bb31c0dec2288452fb3026e9b94a96d3f6f27d933a481cb7c2c371ead7a79dbb
MD5 c735d2cc26351e638f7197a7fb34a658
SHA1 8c9f565aa188604822e9c1263ccb06c02d5d06cf
SHA512 9b35f405fbe4c806854ddbbb392734a499c6247b9f4d6a337b12b48f5ab96a34ecee6a50432039a10ac66f26d42365d5bba332ea1b0f113828dca1fc06b91085
SSDEEP 6144:peSTTdvssD0yVyp5zuds+199Mni2aByDdPz45t5eWkGcMc+bIINEi41XSP:pzTTdvFVypQfunuByDK5t5eWbxkINEiJ
TLSH
T1DB74234BEEC1CAA4C070D530152BBD7FFF6E7F482372258F0BA96A1B4EE5600A571165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_303kqqlh.opz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_303kqqlh.opz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1564-28-0x000001B844280000-0x000001B8442A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads