Overview

overview

10

Static

static

7a90312b84...c0.exe

windows7-x64

8

7a90312b84...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0

  • Size

    600KB

  • Sample

    221129-yaz3pscg7y

  • MD5

    d59d4957cbed239f9f454a958532f0fb

  • SHA1

    20a4c13477daf6d8338b2dd6cd3f15258029974b

  • SHA256

    0141ea4548c515c69c3d61c1463235730c18543654c568512dcedd81d26eeac8

  • SHA512

    4c3da44793007b0683fbf7cd683c4142e40c9c6a8c9de8868197e89cf3dd69129d47fd3368c809024348e5e321bbe0242a7155e6bd2d58deeb79fdbd38ba8152

  • SSDEEP

    12288:mCntmdCr4tMhP5aYJKHVncNbCQB6X/+hiYDq6w:Dt90tMhFJKNUE+E7

Score
10/10
xmrigminer

Malware Config

Targets

    • Target

      7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0

    • Size

      648KB

    • MD5

      4f17d8dcc61d0dea7dd6c4cd0162b246

    • SHA1

      d3a2505f416a32ed98e71117db7188cf1a464c5d

    • SHA256

      7a90312b845d684d8f0a2ae95cfc5f616d00dd25cbcb172335a36dd90c3340c0

    • SHA512

      c4364d742f83dde0aec4a6120f5521bfff3df7e522eb43a3c9bcca6f3fbf3fdd000edb6aeceb2e4c84bebea46a6a3b110f538a982ce41919fb9f8da88ece98b2

    • SSDEEP

      12288:cm+6CtnUrur4tohP1aYZKHbncTnCQB6X/MJiY:x+rpX0tohhZKb+YM

    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks