Overview

overview

10

Static

static

222.bat

windows7_x64

10

222.bat

windows10_x64

10

Resubmissions

16-10-2021 08:50

211016-krydjscfbj 10

16-10-2021 06:51

211016-hmx6wabgb9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    222.bat

  • Size

    89B

  • Sample

    211016-krydjscfbj

  • MD5

    75a4daa4b7e656ded55a6a7865342d04

  • SHA1

    8e52d1f4dfa6bd9501ba89855b44059bf92f699e

  • SHA256

    30899cd09dd5df4bfe5242ef5ff17f353ce1fd07a8c762702c1eb4e2ba8bfba1

  • SHA512

    16fafec07a8ebed3d602c6af50323a2c8e0f784f4d8ccd172d78d935cb7e8a2294a51c02999a04e53efdaf290a5de687cb7654d67f38590eee392431bd7c2334

Score
10/10
xmrigevasionminerpersistenceupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://cat.xiaoshabi.nl/networks.ps1

Targets

    • Target

      222.bat

    • Size

      89B

    • MD5

      75a4daa4b7e656ded55a6a7865342d04

    • SHA1

      8e52d1f4dfa6bd9501ba89855b44059bf92f699e

    • SHA256

      30899cd09dd5df4bfe5242ef5ff17f353ce1fd07a8c762702c1eb4e2ba8bfba1

    • SHA512

      16fafec07a8ebed3d602c6af50323a2c8e0f784f4d8ccd172d78d935cb7e8a2294a51c02999a04e53efdaf290a5de687cb7654d67f38590eee392431bd7c2334

    Score
    10/10
    xmrigevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Sets DLL path for service in the registry

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

2
T1158

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Hidden Files and Directories

2
T1158

Impair Defenses

1
T1562

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks