General

  • Target

    a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f

  • Size

    880KB

  • Sample

    221129-lqbntsgc79

  • MD5

    dc993f2bde7c48504df0a30ed3095b4a

  • SHA1

    a9f030695570274d680c187a133473812e277de4

  • SHA256

    a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f

  • SHA512

    ed82e1fb3aa02b4c633ece17bbe2a5b419e1e7d63abbff662806d62b3d4d8336244f1669938f3459c72d82682c9e56a18da3000453db85b1b3934beaaf003760

  • SSDEEP

    6144:WmERrvsi0oAtnm2cbNrQXL5hevs8OwYP6PG2hTSk9FKrcSPCXiM8kWUXqTlr3fFo:WmSitm2cRg2R9F+cUBYIiYV9XBcZ

Score
10/10

Malware Config

Targets

    • Target

      a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f

    • Size

      880KB

    • MD5

      dc993f2bde7c48504df0a30ed3095b4a

    • SHA1

      a9f030695570274d680c187a133473812e277de4

    • SHA256

      a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f

    • SHA512

      ed82e1fb3aa02b4c633ece17bbe2a5b419e1e7d63abbff662806d62b3d4d8336244f1669938f3459c72d82682c9e56a18da3000453db85b1b3934beaaf003760

    • SSDEEP

      6144:WmERrvsi0oAtnm2cbNrQXL5hevs8OwYP6PG2hTSk9FKrcSPCXiM8kWUXqTlr3fFo:WmSitm2cRg2R9F+cUBYIiYV9XBcZ

    Score
    10/10
    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Detectes Phoenix Miner Payload

    • XMRig Miner payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks