Overview

overview

10

Static

static

5

386382628b...a5.exe

windows7_x64

10

386382628b...a5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    386382628bdab18db3b929a566756da5

  • Size

    15.9MB

  • Sample

    211016-rvqanscghn

  • MD5

    386382628bdab18db3b929a566756da5

  • SHA1

    fcd17baf5894cede249211bab735f97d8f6b5770

  • SHA256

    90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5

  • SHA512

    8916ea2666d16430c26b55fd11f0195a96f352f79cc884029b380f8001cf46f1aa0a9b86d36d8dbc15f39c95b163301546ccbafcde3bedd78ae5267063f52a05

Score
10/10
xmrigminersuricata

Malware Config

Targets

    • Target

      386382628bdab18db3b929a566756da5

    • Size

      15.9MB

    • MD5

      386382628bdab18db3b929a566756da5

    • SHA1

      fcd17baf5894cede249211bab735f97d8f6b5770

    • SHA256

      90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5

    • SHA512

      8916ea2666d16430c26b55fd11f0195a96f352f79cc884029b380f8001cf46f1aa0a9b86d36d8dbc15f39c95b163301546ccbafcde3bedd78ae5267063f52a05

    Score
    10/10
    xmrigminersuricata

    • suricata: ET MALWARE Win32/MOOZ.THCCABO CoinMiner CnC Checkin

      suricata: ET MALWARE Win32/MOOZ.THCCABO CoinMiner CnC Checkin

      suricata

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Detected Stratum cryptominer command

      Looks to be attempting to contact Stratum mining pool.

      miner

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks