General

  • Target

    eb5fcfda27dd7dba6489e9235cb0ebb3.exe

  • Size

    830KB

  • Sample

    201204-k79rxjmeba

  • MD5

    eb5fcfda27dd7dba6489e9235cb0ebb3

  • SHA1

    214d444e61f2ce14eda1d8eb8d6cc46649e67f36

  • SHA256

    649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87

  • SHA512

    0c03ec4898e15e6d8002477433620feb5f2ecf6f98614691c92f81c81922707b7589523c0b172854fa0bd3f47680b4219c18f04fc26a06ff529c77bcf276a172

Malware Config

Targets

    • Target

      eb5fcfda27dd7dba6489e9235cb0ebb3.exe

    • Size

      830KB

    • MD5

      eb5fcfda27dd7dba6489e9235cb0ebb3

    • SHA1

      214d444e61f2ce14eda1d8eb8d6cc46649e67f36

    • SHA256

      649982bca8732a94d5f1e9cc3d87045e3aff04687080036bed0ba298e7957e87

    • SHA512

      0c03ec4898e15e6d8002477433620feb5f2ecf6f98614691c92f81c81922707b7589523c0b172854fa0bd3f47680b4219c18f04fc26a06ff529c77bcf276a172

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • XMRig Miner Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Tasks