Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4b6d729c0d3193dbc7cb08b78d1966864bc43996644532038c839fe96935952

  • Size

    4.1MB

  • Sample

    220815-tbt6macfgm

  • MD5

    e7dad81987aa47ca7e29b74d3e813af1

  • SHA1

    cf2aba2f46ea045d261ec0a8aa82e2093be4dc91

  • SHA256

    c4b6d729c0d3193dbc7cb08b78d1966864bc43996644532038c839fe96935952

  • SHA512

    d997920c6e696971b7c3639d86acc99975b401bbc29d4b175bae55af17400f163ca41b913489b98e4e7fa0aad348e49adb4974e12f96003562df9e13118b8d0c

Score
10/10
xmrigdiscoveryevasionexploitminer

Malware Config

Targets

    • Target

      c4b6d729c0d3193dbc7cb08b78d1966864bc43996644532038c839fe96935952

    • Size

      4.1MB

    • MD5

      e7dad81987aa47ca7e29b74d3e813af1

    • SHA1

      cf2aba2f46ea045d261ec0a8aa82e2093be4dc91

    • SHA256

      c4b6d729c0d3193dbc7cb08b78d1966864bc43996644532038c839fe96935952

    • SHA512

      d997920c6e696971b7c3639d86acc99975b401bbc29d4b175bae55af17400f163ca41b913489b98e4e7fa0aad348e49adb4974e12f96003562df9e13118b8d0c

    Score
    10/10
    xmrigdiscoveryevasionexploitminer

    • Modifies security service

      evasion

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • Modifies file permissions

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks