Overview

overview

10

Static

static

7

taskhost.exe

windows7-x64

10

taskhost.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    taskhost.exe

  • Size

    35.3MB

  • Sample

    221031-yt46rsceh9

  • MD5

    911a11639a40d412466ac9bfca7c1ea1

  • SHA1

    bd79203199a3aa9b4222a80bfe070902c50089b9

  • SHA256

    91303120d9f0da0918f412b1a50134fe780835457b18624013e7502b6171e6dd

  • SHA512

    20a0f6faab8619456dfb8cf5397951a56ea1bff4a3388029a7d19e88b4883cdf2635dcc9c2b71018c1edf1755546924761fd9eb11405fdcb54379c96ec380bdf

  • SSDEEP

    786432:E20/7XQ6bxJzUArhCh5ZKHvqmgcshUtrYVOWkkNRS0IVKi1Nn/vARdbulE:f0zXQ6bnnhC+9oKYcWkylIVDN/vaCE

Score
10/10
xmrigevasionminerthemidatrojan

Malware Config

Targets

    • Target

      taskhost.exe

    • Size

      35.3MB

    • MD5

      911a11639a40d412466ac9bfca7c1ea1

    • SHA1

      bd79203199a3aa9b4222a80bfe070902c50089b9

    • SHA256

      91303120d9f0da0918f412b1a50134fe780835457b18624013e7502b6171e6dd

    • SHA512

      20a0f6faab8619456dfb8cf5397951a56ea1bff4a3388029a7d19e88b4883cdf2635dcc9c2b71018c1edf1755546924761fd9eb11405fdcb54379c96ec380bdf

    • SSDEEP

      786432:E20/7XQ6bxJzUArhCh5ZKHvqmgcshUtrYVOWkkNRS0IVKi1Nn/vARdbulE:f0zXQ6bnnhC+9oKYcWkylIVDN/vaCE

    Score
    10/10
    xmrigevasionminerthemidatrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks