xmrig

Resubmissions

14/11/2023, 19:39

231114-yc3llsgh9y 10

14/11/2023, 19:09

14/11/2023, 19:05

14/11/2023, 19:00

14/11/2023, 16:43

Sharing

Copy URL

Twitter E-mail

General

Target

DFIR (1).zip
Size

2.8MB
Sample

231114-xrl2qsec29
MD5

860c2bda2efbbc6bc2d518f886d003d1
SHA1

a2b44e47134a247bd1d4ae5126a0bd80468e8a0e
SHA256

2b2c8c45805c51153b46502d503a1cdd1034dab53ef568c113de3e21d1df8e60
SHA512

871dc93d87cb6ec786c652e72c7bfe46cd3ca48dc22968a63f66c24a01c0f3d6187fd2b0186c392db975601144e70d8c3faac6c982e10ec8aecf7c16e6c75d6d
SSDEEP

49152:A5W3aiH9S/bHH4DiHtwih/gkeXpC4XVoQPT4se08jh86Dgu9i:wgzH9S/LYDiWi/rEw4CQPT4vDgJ

Score

10^/10

Malware Config

Targets

- Target
  
  DFIR.pdf
- Size
  
  2.8MB
- MD5
  
  e372d1ba2d3a1936e3e8cdd3febf2038
- SHA1
  
  06ed6e0be895945bc78adac9aa0283e50fc93349
- SHA256
  
  137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9
- SHA512
  
  058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70
- SSDEEP
  
  49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR
Score

10^/10

xmrig discovery evasion miner persistence upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Contacts a large (40362) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (40854) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Stops running service(s)
  evasion
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Contacts a large (40362) amount of remote hosts

Contacts a large (40854) amount of remote hosts

Creates a large amount of network flows

XMRig Miner payload

Creates new service(s)

Stops running service(s)

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2