xmrig

General

Target

6cae60231a9570614677ff35656b83cc7b17cbdb343287aed1292131e38e98e7
Size

7.4MB
Sample

220617-18d91agaf5
MD5

e4c04bdc1bbd63879e4d49fc9f3dc8c6
SHA1

614b6d1e11ba6b7784528ada9f1b2215a208398c
SHA256

6cae60231a9570614677ff35656b83cc7b17cbdb343287aed1292131e38e98e7
SHA512

7d39623f5ff0313fd0f495e0fcab9c69fa0efae12a24e70c86e91ec9a37cf1dd3a79ffe8f4cdebbebdc33784cd20b9d27480a34b76fd93b8b16792c80648cb0c

Score

10^/10

Malware Config

Targets

- Target
  
  6cae60231a9570614677ff35656b83cc7b17cbdb343287aed1292131e38e98e7
- Size
  
  7.4MB
- MD5
  
  e4c04bdc1bbd63879e4d49fc9f3dc8c6
- SHA1
  
  614b6d1e11ba6b7784528ada9f1b2215a208398c
- SHA256
  
  6cae60231a9570614677ff35656b83cc7b17cbdb343287aed1292131e38e98e7
- SHA512
  
  7d39623f5ff0313fd0f495e0fcab9c69fa0efae12a24e70c86e91ec9a37cf1dd3a79ffe8f4cdebbebdc33784cd20b9d27480a34b76fd93b8b16792c80648cb0c
Score

10^/10

xmrig discovery evasion exploit miner themida trojan
- Modifies security service
  evasion
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner Payload
  miner
- Blocklisted process makes network request
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2