xmrig

General

Target

d4fc8415802d26f5902a925dafa09f95.bin
Size

3.7MB
Sample

230317-jxgsbaha8t
MD5

1d3ab40ec7cdfa8f1a76abd6499543c2
SHA1

b6fd9576123acd3ceae94b1b7139ec6fb8038f6c
SHA256

ce83770a03ddb0a885e1bfa237f190c18f88ba84361896cbb476f1b31189b5f8
SHA512

33636349092a9b1a66e6dcf1e54ba4ab530f9278d9eb2cd7b6928c2b8a4c2936f6b39b3e67a29435a109c345923cac316af535e521541006865ed7f03ac7ad8f
SSDEEP

98304:xecn8mtZVE7lz+JX41EdwNf8Lp8YTLkGEG:xRn8mi7lz+541EdwNf8l8YTwGJ

Score

10^/10

Malware Config

Targets

- Target
  
  b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f.exe
- Size
  
  3.7MB
- MD5
  
  d4fc8415802d26f5902a925dafa09f95
- SHA1
  
  76a6da00893bf5fa29e9b9a6e69e83e1ded5856c
- SHA256
  
  b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f
- SHA512
  
  741da8d09f76f645557c668cde3d05155e0497bae6a431fa81f85b8ace7ab16be35ecebf3a56f6a019dbafe72cd8ed916dc4ae3615e35c615d1c841fc84420c9
- SSDEEP
  
  98304:GUwJ6Lv3608hjXk/o58364xowyoYLDVEjIHpnzwu7GsD:CSv61hjXk/W8364xowMqcnzwuCg
Score

10^/10

persistence upx xmrig miner
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

XMRig Miner payload

Blocklisted process makes network request

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2