Overview

overview

10

Static

static

10

0x00080000...90.exe

windows7-x64

10

0x00080000...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x000800000001628c-90.dat

  • Size

    4.0MB

  • Sample

    230727-rmgcssfc36

  • MD5

    d0cc6d35827351c327a72dbd86542d2f

  • SHA1

    ebd3d0bf770e05e0f93c4241e7169d39cc86e5fd

  • SHA256

    3a662fa4c1c6b1b2e4ee8ae6ef9f6c3e8d0c9c19644a8cab9f8b5ec803614bc8

  • SHA512

    7c10261f20ededeaf1c1df7609040d91affbfcc2b7a2b2d7ef88d78c66efd1767e1c9c79fbcc5889e397d078337c40ab902088c99e20fc6258695103fed56ea4

  • SSDEEP

    49152:ZNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:PzP88fBsnZTgOtqB3m1RC3

Score
10/10
loaderbotxmrigloaderminerpersistence

Malware Config

Targets

    • Target

      0x000800000001628c-90.dat

    • Size

      4.0MB

    • MD5

      d0cc6d35827351c327a72dbd86542d2f

    • SHA1

      ebd3d0bf770e05e0f93c4241e7169d39cc86e5fd

    • SHA256

      3a662fa4c1c6b1b2e4ee8ae6ef9f6c3e8d0c9c19644a8cab9f8b5ec803614bc8

    • SHA512

      7c10261f20ededeaf1c1df7609040d91affbfcc2b7a2b2d7ef88d78c66efd1767e1c9c79fbcc5889e397d078337c40ab902088c99e20fc6258695103fed56ea4

    • SSDEEP

      49152:ZNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:PzP88fBsnZTgOtqB3m1RC3

    Score
    10/10
    loaderbotxmrigloaderminerpersistence

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • LoaderBot executable

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks