Overview

overview

10

Static

static

winprofile

windows7-x64

6

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4bc0106363b1f9157405ffc64d4c5632f86a86b3e466dfc3f909127049e370c

  • Size

    10KB

  • Sample

    221130-fe6f6sca7z

  • MD5

    b3014f9ea7de6b7acb56519e9e02a879

  • SHA1

    030cf651b1e0ba2405b758f22d28ca86ed46a1de

  • SHA256

    e4bc0106363b1f9157405ffc64d4c5632f86a86b3e466dfc3f909127049e370c

  • SHA512

    a6d93dd44d3ef34d0dcdab36b72e5b7392681202a528799f4d77831b7b25380a37d6ad0d0bc617bf894cb0cb5344489c6116392134bbdb70433c838f2e27a93a

  • SSDEEP

    192:v7Cja853xv6+bLlllCdA78stYcFmVc03KY:TCjlvXbLdaA7ptYcFmVc03K

Score
10/10
xmrigminerpersistence

Malware Config

Targets

    • Target

      e4bc0106363b1f9157405ffc64d4c5632f86a86b3e466dfc3f909127049e370c

    • Size

      10KB

    • MD5

      b3014f9ea7de6b7acb56519e9e02a879

    • SHA1

      030cf651b1e0ba2405b758f22d28ca86ed46a1de

    • SHA256

      e4bc0106363b1f9157405ffc64d4c5632f86a86b3e466dfc3f909127049e370c

    • SHA512

      a6d93dd44d3ef34d0dcdab36b72e5b7392681202a528799f4d77831b7b25380a37d6ad0d0bc617bf894cb0cb5344489c6116392134bbdb70433c838f2e27a93a

    • SSDEEP

      192:v7Cja853xv6+bLlllCdA78stYcFmVc03KY:TCjlvXbLdaA7ptYcFmVc03K

    Score
    10/10
    persistencexmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks