Overview

overview

10

Static

static

c671c02459...2a.exe

windows7_x64

10

c671c02459...2a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c671c024595fbae1bcb523930b41952a.bin

  • Size

    6.7MB

  • Sample

    220513-fndshsfedp

  • MD5

    c671c024595fbae1bcb523930b41952a

  • SHA1

    af16bda06ebf490087aac1e444e25017e180c7d4

  • SHA256

    39b66a47affa0edde59d74760fc17de28c0d3cbabe7469d382a721ea91b5c123

  • SHA512

    fb1d9e0488eb247c54b86a0fbb7f1929d6ead0de3502d44e5db701aff3b3df0d7b312939e02bb89790006ea4337dc63b973ce5a2971e132a4188d003ddc95a3b

Score
10/10
xmrigdiscoveryevasionexploitminerpersistencesuricata

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.81.224.130/any.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.81.224.130/curl.exe

Targets

    • Target

      c671c024595fbae1bcb523930b41952a.bin

    • Size

      6.7MB

    • MD5

      c671c024595fbae1bcb523930b41952a

    • SHA1

      af16bda06ebf490087aac1e444e25017e180c7d4

    • SHA256

      39b66a47affa0edde59d74760fc17de28c0d3cbabe7469d382a721ea91b5c123

    • SHA512

      fb1d9e0488eb247c54b86a0fbb7f1929d6ead0de3502d44e5db701aff3b3df0d7b312939e02bb89790006ea4337dc63b973ce5a2971e132a4188d003ddc95a3b

    Score
    10/10
    xmrigdiscoveryevasionexploitminerpersistencesuricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Blocklisted process makes network request

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Privilege Escalation

New Service

1
T1050

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks