xmrig

General

Target

services64.exe
Size

7.1MB
Sample

220413-qmskdscda9
MD5

4958cbddbfb690e6710cb73084004292
SHA1

2e78719c61511fedfd3b75f41d1e4b7feda96967
SHA256

d7428420538d01356c483f838c10798cb05da2993e5aafb68f4748ce8dc64113
SHA512

4d54b244ea89030da30f6ff7de2371f9bc238f7133c9c6b8ee9b67311abedd391e7a4cf4ac3bdbeeadb04fbeca77f3e38b2d82a47e672cb531c920e3a7dbb994

Score

10^/10

Malware Config

Targets

- Target
  
  services64.exe
- Size
  
  7.1MB
- MD5
  
  4958cbddbfb690e6710cb73084004292
- SHA1
  
  2e78719c61511fedfd3b75f41d1e4b7feda96967
- SHA256
  
  d7428420538d01356c483f838c10798cb05da2993e5aafb68f4748ce8dc64113
- SHA512
  
  4d54b244ea89030da30f6ff7de2371f9bc238f7133c9c6b8ee9b67311abedd391e7a4cf4ac3bdbeeadb04fbeca77f3e38b2d82a47e672cb531c920e3a7dbb994
Score

10^/10

xmrig bootkit discovery evasion exploit miner persistence
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner Payload
  miner
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2