Overview

overview

10

Static

static

10

________ _...__.exe

windows7_x64

10

________ _...__.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    010b8f865dce90452f05c5ae0e9f05731af9a9ebcc6e73c9359d7163c0bfe935

  • Size

    430KB

  • Sample

    220524-cx5e2scdg8

  • MD5

    bed201c48e30db0c1309fb9179337a2b

  • SHA1

    5a206a9d39d01576cc77760b23b7be0aea56c68b

  • SHA256

    010b8f865dce90452f05c5ae0e9f05731af9a9ebcc6e73c9359d7163c0bfe935

  • SHA512

    b31e59637d545f517123854d048cc332173d6554a275417f003b79e07c56f694ce40942a0981d2639818dc0ba907c26e9b0f5427b0a6ce976066df512af91fb5

Score
10/10
loaderbotxmrigminerpersistence

Malware Config

Targets

    • Target

      ________ ___________.bin

    • Size

      1.1MB

    • MD5

      35b94119f76089e8937496e6942fb9dd

    • SHA1

      8cc1318e56d7f57ac2c1f62ebfffdd2ad68c4d7c

    • SHA256

      f69025c3989bcf53faa23fb240fc6710ab36ed36c13b5c2fa78c8725772dbe4f

    • SHA512

      d899970fbb9dc843def051d03830cc76a27b9ea4fab9b4785eba901a45d85d1db91cfa2d7f2e7458a1353636a98d012842e831f34e6b2c7fc69e43d0db150348

    Score
    10/10
    xmrigminerpersistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Detected Stratum cryptominer command

      Looks to be attempting to contact Stratum mining pool.

      miner

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Cryptocurrency Miner

      Makes network request to known mining pool URL.

      miner

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks