Overview

overview

10

Static

static

10

026d6396aa...87.exe

windows7_x64

10

026d6396aa...87.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    026d6396aafd4e1706c5ec311de66487.exe

  • Size

    112KB

  • Sample

    211025-jerjssfge2

  • MD5

    026d6396aafd4e1706c5ec311de66487

  • SHA1

    01a43562db3eb021aa4531c2e292fa92414cff0c

  • SHA256

    9ca0de5b060df94714b3defd24f99d53e63414abdee90e113647b77ed3ea9036

  • SHA512

    d080ea922b4d9831ca0d69841046ebb6248f517f7732557ccc9961f28e3b2c58fee0b6e1a5916256fd2d065a3db8eedee017c9021ba2648fe2de1c359e30e091

Score
10/10
runningratxmrigminerpersistence

Malware Config

Targets

    • Target

      026d6396aafd4e1706c5ec311de66487.exe

    • Size

      112KB

    • MD5

      026d6396aafd4e1706c5ec311de66487

    • SHA1

      01a43562db3eb021aa4531c2e292fa92414cff0c

    • SHA256

      9ca0de5b060df94714b3defd24f99d53e63414abdee90e113647b77ed3ea9036

    • SHA512

      d080ea922b4d9831ca0d69841046ebb6248f517f7732557ccc9961f28e3b2c58fee0b6e1a5916256fd2d065a3db8eedee017c9021ba2648fe2de1c359e30e091

    Score
    10/10
    xmrigminerpersistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Creates a Windows Service

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks