Overview

overview

10

Static

static

9f85b7f618...c3.exe

windows7_x64

10

9f85b7f618...c3.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5020890479493120.zip

  • Size

    300KB

  • Sample

    210628-47k4rk3nfn

  • MD5

    c8816c0684d03585a95b9590048d7527

  • SHA1

    29a7b6b74769403c8d96a788fbfa4a39d37d3334

  • SHA256

    3f955e5f8b418362e0fe21f82a1a4b5f6e94abbf6cb9593384e3bdaf6756112d

  • SHA512

    cb4b69cc1a65ce6f6161b7cdbf00708806bf4a335b3e22c166b719d16cac0b2dd06e863cd9007b06028801bba5d87df2bbb9fc5a58cc196a0b2fb84b4f0fc0b1

Score
10/10
xmrigevasionminerpersistenceransomware

Malware Config

Targets

    • Target

      9f85b7f6182409d3731b67da09006dc99be2fc82637160e93fb2b71e13ff62c3

    • Size

      347KB

    • MD5

      31441b2bcb3e56815b1a2865a73d5ed8

    • SHA1

      ff92e087b723d2b4c53316366930514b8f27b7bc

    • SHA256

      9f85b7f6182409d3731b67da09006dc99be2fc82637160e93fb2b71e13ff62c3

    • SHA512

      01973b6cead3f5c332e499d2281cd92a595ca2ea5eca953f4202e4e6f5892e147c329c029a324b286e9bfebfd169603342b2df660bbb58f862eea16772627ffd

    Score
    10/10
    xmrigevasionminerpersistenceransomware

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Disables Task Manager via registry modification

      evasion

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Tasks