Overview

overview

10

Static

static

1

da6e6cc882...9b.exe

windows7-x64

10

da6e6cc882...9b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    da6e6cc88243db08b8d63a7cfbfda36d3f98684b4e3b669f807b8b3f4536779b

  • Size

    5.1MB

  • Sample

    231120-mmqt1sfc99

  • MD5

    a7372c36c845147ba0bb4caff8997bc4

  • SHA1

    7637709465b766a4f3c1cf9c9e0c04cf776567a4

  • SHA256

    da6e6cc88243db08b8d63a7cfbfda36d3f98684b4e3b669f807b8b3f4536779b

  • SHA512

    55f4801386ca5ed3ddac7c97e52991b7c5ed13649920c537b61579e69ea06ca1a3e98c35aae767ef59ae4e2d9ff0b05c2cbaff68bd653bc9ec9f86d1457930ff

  • SSDEEP

    98304:EGMD04y4suYiVEpvYXmP7PpFYf2DlZHK/3BykfDfitACArN5+0vSLIeAR:EaSwqsYf2DlZHK/By2f+FArNw0vWIeAR

Score
10/10
xmrigevasionminerpersistenceupx

Malware Config

Targets

    • Target

      da6e6cc88243db08b8d63a7cfbfda36d3f98684b4e3b669f807b8b3f4536779b

    • Size

      5.1MB

    • MD5

      a7372c36c845147ba0bb4caff8997bc4

    • SHA1

      7637709465b766a4f3c1cf9c9e0c04cf776567a4

    • SHA256

      da6e6cc88243db08b8d63a7cfbfda36d3f98684b4e3b669f807b8b3f4536779b

    • SHA512

      55f4801386ca5ed3ddac7c97e52991b7c5ed13649920c537b61579e69ea06ca1a3e98c35aae767ef59ae4e2d9ff0b05c2cbaff68bd653bc9ec9f86d1457930ff

    • SSDEEP

      98304:EGMD04y4suYiVEpvYXmP7PpFYf2DlZHK/3BykfDfitACArN5+0vSLIeAR:EaSwqsYf2DlZHK/By2f+FArNw0vWIeAR

    Score
    10/10
    xmrigevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Drops file in Drivers directory

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks