Overview

overview

10

Static

static

10

2812-28-0x...ry.exe

windows7-x64

2812-28-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2812-28-0x0000000000D30000-0x0000000001764000-memory.dmp

  • Size

    10.2MB

  • Sample

    231105-yerl5abc6v

  • MD5

    471e1ef5f5b5f565edfdb50280186890

  • SHA1

    1d9eef098e334545019eb143a663d83e4d594536

  • SHA256

    1752db737ed003a62b9f7ce7e8101b2fa8bde2718951430bdc52ae858768a6fd

  • SHA512

    e160d8dc1309589c35831160362d837e9914abd9ff81470db13163eeeb10fd1e218d3d83012795ca246ceff8cba6acfe82224a5207a22fcc9298d717c40149f9

  • SSDEEP

    98304:vzP88fBsnZTgOtqB3m1RC3XORpug4OZeZ3fq4bBvzeszWpJj1z2ge+u/3qXuD5OK:brpkE3aRC3Hg4bpqsyJ4g3uPIuFKay

Score
10/10
loaderbotxmrigloaderminerpersistencethemida

Malware Config

Targets

    • Target

      2812-28-0x0000000000D30000-0x0000000001764000-memory.dmp

    • Size

      10.2MB

    • MD5

      471e1ef5f5b5f565edfdb50280186890

    • SHA1

      1d9eef098e334545019eb143a663d83e4d594536

    • SHA256

      1752db737ed003a62b9f7ce7e8101b2fa8bde2718951430bdc52ae858768a6fd

    • SHA512

      e160d8dc1309589c35831160362d837e9914abd9ff81470db13163eeeb10fd1e218d3d83012795ca246ceff8cba6acfe82224a5207a22fcc9298d717c40149f9

    • SSDEEP

      98304:vzP88fBsnZTgOtqB3m1RC3XORpug4OZeZ3fq4bBvzeszWpJj1z2ge+u/3qXuD5OK:brpkE3aRC3Hg4bpqsyJ4g3uPIuFKay

    Score
    10/10
    loaderbotxmrigloaderminerpersistencethemida

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • LoaderBot executable

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks