Overview

overview

10

Static

static

8

4b61679662...9e.exe

windows7_x64

8

4b61679662...9e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e

  • Size

    2.1MB

  • Sample

    220520-w9evpscbc9

  • MD5

    087d6c8306538655e99a7cbc734152e6

  • SHA1

    3f4499b01e23549ce5c2992ffaf098de9ed4cbc6

  • SHA256

    4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e

  • SHA512

    60b8822d1cff7fb8b82484a50fb195148d9f0d11c5d5d14a9f01c5622a324ec433828087c32416037b0567d68527364d6795bb302575d6b5e739e027ea400b40

Score
10/10
xmrigevasionminerupx

Malware Config

Targets

    • Target

      4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e

    • Size

      2.1MB

    • MD5

      087d6c8306538655e99a7cbc734152e6

    • SHA1

      3f4499b01e23549ce5c2992ffaf098de9ed4cbc6

    • SHA256

      4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e

    • SHA512

      60b8822d1cff7fb8b82484a50fb195148d9f0d11c5d5d14a9f01c5622a324ec433828087c32416037b0567d68527364d6795bb302575d6b5e739e027ea400b40

    Score
    10/10
    evasionupxxmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Detected Stratum cryptominer command

      Looks to be attempting to contact Stratum mining pool.

      miner

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks