Overview

overview

10

Static

static

efd0bce60a...0a.exe

windows7_x64

10

efd0bce60a...0a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4995084973801472.zip

  • Size

    163KB

  • Sample

    210629-rqby5v2cbx

  • MD5

    cf9f9d02d6709a3913c97d5f13ff214a

  • SHA1

    6d1ec4978c2b036eb7a80ba260fb98f4c46deb6f

  • SHA256

    5e8d14cbdbead3eba2ddcfbe06c86a01b31fc5b498a1162685353a185a579272

  • SHA512

    a4c5aaad79da0b473ec718516566e18825df6523ffb869fc3a685869ff93739aa355e32d5c6389732db5279b62d67482d4d768599f4c6e4569810b4c1d6aa48c

Score
10/10
xmrigevasionminerpersistence

Malware Config

Targets

    • Target

      efd0bce60a705a826b468998268ec5f21323abf129974387d83a6b5f5113220a

    • Size

      3.7MB

    • MD5

      28982a69734571348f710e41aa720811

    • SHA1

      4577caefc0e05c4079098eb0563d85fa5301003b

    • SHA256

      efd0bce60a705a826b468998268ec5f21323abf129974387d83a6b5f5113220a

    • SHA512

      30b5251bd35a6735fbb0e77104a31ff664de2c02f76b7d929ba446f2f3b5e8683059f61b055fa2d966eacadfaa59593f8d7ea1fe9d27f998c1d5c614352b5fd9

    Score
    10/10
    xmrigevasionminerpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks