Overview

overview

10

Static

static

7

DFIR.exe

windows7-x64

10

DFIR.exe

windows10-2004-x64

10

Resubmissions

14/11/2023, 19:39

231114-yc3llsgh9y 10

14/11/2023, 19:09

231114-xts8tsfg81 10

14/11/2023, 19:05

231114-xrl2qsec29 10

14/11/2023, 19:00

231114-xnxztsdh75 10

14/11/2023, 16:43

231114-t8cmvadf6s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DFIR (1).zip

  • Size

    2.8MB

  • Sample

    231114-t8cmvadf6s

  • MD5

    860c2bda2efbbc6bc2d518f886d003d1

  • SHA1

    a2b44e47134a247bd1d4ae5126a0bd80468e8a0e

  • SHA256

    2b2c8c45805c51153b46502d503a1cdd1034dab53ef568c113de3e21d1df8e60

  • SHA512

    871dc93d87cb6ec786c652e72c7bfe46cd3ca48dc22968a63f66c24a01c0f3d6187fd2b0186c392db975601144e70d8c3faac6c982e10ec8aecf7c16e6c75d6d

  • SSDEEP

    49152:A5W3aiH9S/bHH4DiHtwih/gkeXpC4XVoQPT4se08jh86Dgu9i:wgzH9S/LYDiWi/rEw4CQPT4vDgJ

Score
10/10
xmrigdiscoveryevasionminerpersistenceupx

Malware Config

Targets

    • Target

      DFIR.pdf

    • Size

      2.8MB

    • MD5

      e372d1ba2d3a1936e3e8cdd3febf2038

    • SHA1

      06ed6e0be895945bc78adac9aa0283e50fc93349

    • SHA256

      137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9

    • SHA512

      058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70

    • SSDEEP

      49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR

    Score
    10/10
    xmrigdiscoveryevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Contacts a large (157669) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (307039) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks