Overview

overview

10

Static

static

c32ff3c02f...4e.exe

windows7_x64

10

c32ff3c02f...4e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c32ff3c02f5ec47707631568f2f5435e3391820a7c238925a782e6e74656134e

  • Size

    9.4MB

  • Sample

    220520-g6rb1aghcm

  • MD5

    c014edde246b35f3a7379cb4c5e1185e

  • SHA1

    584ae3a33acdd163750007847543826a15d95df9

  • SHA256

    c32ff3c02f5ec47707631568f2f5435e3391820a7c238925a782e6e74656134e

  • SHA512

    522c4fa3645c30ed1e863b52cbf1f089a0c41075e52b5323c7079ab3ef80b850893d5be49f5c7a047f284c901ba56801a5d626e2a3d4e4c99f18d36e72f7e4be

Score
10/10
xmrigminerpersistenceupx

Malware Config

Targets

    • Target

      c32ff3c02f5ec47707631568f2f5435e3391820a7c238925a782e6e74656134e

    • Size

      9.4MB

    • MD5

      c014edde246b35f3a7379cb4c5e1185e

    • SHA1

      584ae3a33acdd163750007847543826a15d95df9

    • SHA256

      c32ff3c02f5ec47707631568f2f5435e3391820a7c238925a782e6e74656134e

    • SHA512

      522c4fa3645c30ed1e863b52cbf1f089a0c41075e52b5323c7079ab3ef80b850893d5be49f5c7a047f284c901ba56801a5d626e2a3d4e4c99f18d36e72f7e4be

    Score
    10/10
    xmrigminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks