Overview

overview

10

Static

static

1

SockaBlet.exe

windows7-x64

10

SockaBlet.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SockaBlet.exe

  • Size

    2.0MB

  • Sample

    230328-k2en7aaa62

  • MD5

    9c84a7a992b37ae6ad3f39b8435f953c

  • SHA1

    81c0475316d118665983b78eb7b85599fae61138

  • SHA256

    4e5fbc23bbecadfc537e5f3b83d12331052289364be3b2116a1dbd0296097354

  • SHA512

    d9ed4faf75450a500945a8f7de03e6086cffb2f780fc7e4bb83e40301718c8aebdd74b07fb41a1dac9165f15e7b4e02aef68312e52b9dd8f238457f4f899578d

  • SSDEEP

    49152:EMTGvc8bU8qOJFBfqK/tuZmsXz08r+gNZTruavlOpb:EMacQVtFPOmuA8HNZTKCOp

Score
10/10
xmrigminerupx

Malware Config

Targets

    • Target

      SockaBlet.exe

    • Size

      2.0MB

    • MD5

      9c84a7a992b37ae6ad3f39b8435f953c

    • SHA1

      81c0475316d118665983b78eb7b85599fae61138

    • SHA256

      4e5fbc23bbecadfc537e5f3b83d12331052289364be3b2116a1dbd0296097354

    • SHA512

      d9ed4faf75450a500945a8f7de03e6086cffb2f780fc7e4bb83e40301718c8aebdd74b07fb41a1dac9165f15e7b4e02aef68312e52b9dd8f238457f4f899578d

    • SSDEEP

      49152:EMTGvc8bU8qOJFBfqK/tuZmsXz08r+gNZTruavlOpb:EMacQVtFPOmuA8HNZTKCOp

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks