Overview

overview

10

Static

static

1

file.exe

windows7-x64

6

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    2.6MB

  • Sample

    230329-xwh6mshe95

  • MD5

    e0a64ea350aed7cc5e867677944b03e3

  • SHA1

    e0f62ed674ba6c79b215d82babc733f05623ab24

  • SHA256

    1d3329d2fc6d022e283a519b328991098f0d9c7bf01fa2eeaa941ec3bc44b2ef

  • SHA512

    921c94526b0b30fa32d46d11474133cbbb69e2c816b26e54a7002649ad100787b83e33d7369119c4feb1462d8a8db58889355a030a2ba4fe0f1ca904472e1ccb

  • SSDEEP

    24576:q5vWSTfOvF//1SbrNnT/feTtJ2h8IYb2ny/v/LtGZsYjot0VHeaw5qGabocdcyoQ:q5vWSw0bUTWHMqT3dYMfY/HDr/G

Score
10/10
xmrigminerpersistence

Malware Config

Targets

    • Target

      file.exe

    • Size

      2.6MB

    • MD5

      e0a64ea350aed7cc5e867677944b03e3

    • SHA1

      e0f62ed674ba6c79b215d82babc733f05623ab24

    • SHA256

      1d3329d2fc6d022e283a519b328991098f0d9c7bf01fa2eeaa941ec3bc44b2ef

    • SHA512

      921c94526b0b30fa32d46d11474133cbbb69e2c816b26e54a7002649ad100787b83e33d7369119c4feb1462d8a8db58889355a030a2ba4fe0f1ca904472e1ccb

    • SSDEEP

      24576:q5vWSTfOvF//1SbrNnT/feTtJ2h8IYb2ny/v/LtGZsYjot0VHeaw5qGabocdcyoQ:q5vWSw0bUTWHMqT3dYMfY/HDr/G

    Score
    10/10
    persistencexmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks