Overview

overview

10

Static

static

Forever

windows7_x64

10

Resubmissions

08-01-2021 15:21

210108-kdkln37l9x 10

08-01-2021 08:51

210108-fpetcw5rxj 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    defenderModule.exe

  • Size

    47.9MB

  • Sample

    210108-kdkln37l9x

  • MD5

    8e8bae165f8891a4b74b38fc79f6f159

  • SHA1

    ecc64521a67db9d51625c5e2795536e2d182327e

  • SHA256

    a7c4d788dbcdbb75154a25b57bb71cd1186d412fd776986fac561b74af224efd

  • SHA512

    b5863051f8208b63418b48737a1de0c488594ca6cf6ab4410fa568995d9c8130e388989995b2dde243439aa8f28ddddabbc950ff360a3c33eed51d9ca7b76db0

Score
10/10
darkcometxmrigevasionminerrattrojan

Malware Config

Targets

    • Target

      defenderModule.exe

    • Size

      47.9MB

    • MD5

      8e8bae165f8891a4b74b38fc79f6f159

    • SHA1

      ecc64521a67db9d51625c5e2795536e2d182327e

    • SHA256

      a7c4d788dbcdbb75154a25b57bb71cd1186d412fd776986fac561b74af224efd

    • SHA512

      b5863051f8208b63418b48737a1de0c488594ca6cf6ab4410fa568995d9c8130e388989995b2dde243439aa8f28ddddabbc950ff360a3c33eed51d9ca7b76db0

    Score
    10/10
    darkcometxmrigevasionminerrattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks