Overview

overview

10

Static

static

sample.exe

windows7_x64

10

sample.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample.exe

  • Size

    4.6MB

  • Sample

    210708-2gknd1qlwn

  • MD5

    97a2004028b9687561993ed9cabc0ee4

  • SHA1

    3d35d423479b1b8a755144c30a4b347d4f915175

  • SHA256

    5ceca4728f509e3b8b58f71296472de6572c63db934b2e9c2530cae561ae608a

  • SHA512

    e0c196fd1e70d01910ea2a944ad46d7aeb87a34efc305a904ec2dde2848ce76e744beb638611c45d292c2733b7a4bcf93e76297fda80ddd2b8c9e103c35c1de0

Score
10/10
xmrigbootkitmacrominerpersistence

Malware Config

Targets

    • Target

      sample.exe

    • Size

      4.6MB

    • MD5

      97a2004028b9687561993ed9cabc0ee4

    • SHA1

      3d35d423479b1b8a755144c30a4b347d4f915175

    • SHA256

      5ceca4728f509e3b8b58f71296472de6572c63db934b2e9c2530cae561ae608a

    • SHA512

      e0c196fd1e70d01910ea2a944ad46d7aeb87a34efc305a904ec2dde2848ce76e744beb638611c45d292c2733b7a4bcf93e76297fda80ddd2b8c9e103c35c1de0

    Score
    10/10
    xmrigbootkitminerpersistencemacro

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks