Overview

overview

10

Static

static

m2.dat.exe

windows7_x64

10

m2.dat.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    m2.dat

  • Size

    3.4MB

  • Sample

    211201-wq4dyshgg7

  • MD5

    fcfc0feed527d188d6b2ed3445758511

  • SHA1

    b4198d332b59b303e2dc5df717f2cf408b308f28

  • SHA256

    28e5812c8bff42c348a5f25a5f3d871c5b3bbda882da1009db4d25dc974bef0c

  • SHA512

    af053c75e89e18573161dcd1fcabc3b08998874c5e810bc15bb2a0e5ab0254d06b4ec6defc545fc9dff4fcb94529eb9ea7610ad63233e5d6e191b232c502d3c5

Score
10/10
xmrigevasionminer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://k2ygoods.ydns.eu/power.txt

Targets

    • Target

      m2.dat

    • Size

      3.4MB

    • MD5

      fcfc0feed527d188d6b2ed3445758511

    • SHA1

      b4198d332b59b303e2dc5df717f2cf408b308f28

    • SHA256

      28e5812c8bff42c348a5f25a5f3d871c5b3bbda882da1009db4d25dc974bef0c

    • SHA512

      af053c75e89e18573161dcd1fcabc3b08998874c5e810bc15bb2a0e5ab0254d06b4ec6defc545fc9dff4fcb94529eb9ea7610ad63233e5d6e191b232c502d3c5

    Score
    10/10
    xmrigevasionminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Impair Defenses

1
T1562

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks