Overview

overview

10

Static

static

de03b648d4...60.exe

windows7_x64

10

de03b648d4...60.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de03b648d4c683ae3acac11fbbb8d88525caa94055cd5e0558eb03c87e91a860

  • Size

    18.1MB

  • Sample

    210504-wrjkpa4fwj

  • MD5

    c380e73a3b87706adcc9750e1716d008

  • SHA1

    fe10dcfaf91d04295323fd61de14757da3683128

  • SHA256

    de03b648d4c683ae3acac11fbbb8d88525caa94055cd5e0558eb03c87e91a860

  • SHA512

    f157618a00990f42800dd95772b257b75379e603fb8edc67406f32f5fec2670178b95d7652c4b08fc125fd1a19af99731922c233d33ac34b4087aadd2c2ceff4

Score
10/10
xmrigminerpersistence

Malware Config

Targets

    • Target

      de03b648d4c683ae3acac11fbbb8d88525caa94055cd5e0558eb03c87e91a860

    • Size

      18.1MB

    • MD5

      c380e73a3b87706adcc9750e1716d008

    • SHA1

      fe10dcfaf91d04295323fd61de14757da3683128

    • SHA256

      de03b648d4c683ae3acac11fbbb8d88525caa94055cd5e0558eb03c87e91a860

    • SHA512

      f157618a00990f42800dd95772b257b75379e603fb8edc67406f32f5fec2670178b95d7652c4b08fc125fd1a19af99731922c233d33ac34b4087aadd2c2ceff4

    Score
    10/10
    xmrigminerpersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks