Overview

overview

10

Static

static

3

8633597731...42.exe

windows7-x64

10

8633597731...42.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    863359773158308ac17b5340a3b76242.exe

  • Size

    2.0MB

  • Sample

    230615-ztndpabb61

  • MD5

    863359773158308ac17b5340a3b76242

  • SHA1

    8bbb4206827d73f08ef39f84db68f47f81f8d776

  • SHA256

    e80c9b5cada25f7888b69a93fd8ecc8f887b8f399abe0641c4c4f97c3a526db9

  • SHA512

    2feef58ceb9878fb157287003ee5ef3bd48b1f5e52018862c12df6b70737d3cada80a01a7bdf9444b4800b48170b0d326dcc4b39ee0a507de56e4edd64c36eb5

  • SSDEEP

    49152:OoGin4osB4YAvR0hvKg3oNG/lgLVqwBmBSnwyCKJmmBp6e:OViXv+hvKmoBBmBktCZmBpR

Score
10/10
xmrigminerupx

Malware Config

Targets

    • Target

      863359773158308ac17b5340a3b76242.exe

    • Size

      2.0MB

    • MD5

      863359773158308ac17b5340a3b76242

    • SHA1

      8bbb4206827d73f08ef39f84db68f47f81f8d776

    • SHA256

      e80c9b5cada25f7888b69a93fd8ecc8f887b8f399abe0641c4c4f97c3a526db9

    • SHA512

      2feef58ceb9878fb157287003ee5ef3bd48b1f5e52018862c12df6b70737d3cada80a01a7bdf9444b4800b48170b0d326dcc4b39ee0a507de56e4edd64c36eb5

    • SSDEEP

      49152:OoGin4osB4YAvR0hvKg3oNG/lgLVqwBmBSnwyCKJmmBp6e:OViXv+hvKmoBBmBktCZmBpR

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks