Overview

overview

10

Static

static

10

8e858f9d9c...b0.exe

windows7_x64

10

8e858f9d9c...b0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e858f9d9c8a2be6c886cb48c311362930563a936db705e4e96f7f55984f96b0

  • Size

    2.3MB

  • Sample

    220516-n15e1achep

  • MD5

    054fd37604886bea787647ac00e5be20

  • SHA1

    085e442c1c85da944292fd0b27e7df4acfd0dbea

  • SHA256

    8e858f9d9c8a2be6c886cb48c311362930563a936db705e4e96f7f55984f96b0

  • SHA512

    0bf2d923fd8ff36682cd361b2b2bb57a728b302f37002e09e2494cbfd30b66f5831620110ec40cd45d5d174bd23c42170cf8e71d63d577150444dc565b9c266f

Score
10/10
xmrigminerupx

Malware Config

Targets

    • Target

      8e858f9d9c8a2be6c886cb48c311362930563a936db705e4e96f7f55984f96b0

    • Size

      2.3MB

    • MD5

      054fd37604886bea787647ac00e5be20

    • SHA1

      085e442c1c85da944292fd0b27e7df4acfd0dbea

    • SHA256

      8e858f9d9c8a2be6c886cb48c311362930563a936db705e4e96f7f55984f96b0

    • SHA512

      0bf2d923fd8ff36682cd361b2b2bb57a728b302f37002e09e2494cbfd30b66f5831620110ec40cd45d5d174bd23c42170cf8e71d63d577150444dc565b9c266f

    Score
    10/10
    xmrigminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks