Overview

overview

10

Static

static

3

3554553.exe

windows7-x64

10

3554553.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3554553.exe

  • Size

    4.5MB

  • Sample

    231225-vlthhsdbb6

  • MD5

    25a1e0a4d436eea408e79a07f45ff684

  • SHA1

    da6fbf78868b855451769fb1255f7c2cdef66ace

  • SHA256

    8f4c3348423dbc5dadff663216b4b015109535a06e5a81fb7cb3993a90ff26c5

  • SHA512

    f7d17b6ce23042d30d9f9bad91684e627b1f8f9bb79ec2c67c3b79791f5444a2fabdcccee48ef3335df3a262060a7300d32aa81a36a1e48fc4299b6668e91df5

  • SSDEEP

    98304:pKF6T4Y6cTie8X081BO2hVvXMtld70frtH1EOq+kYc6EPGo7v4+uT:QFrdSiekO2XvXMtld7WkYc6EC+uT

Score
10/10
xmrigevasionminerpersistenceupx

Malware Config

Targets

    • Target

      3554553.exe

    • Size

      4.5MB

    • MD5

      25a1e0a4d436eea408e79a07f45ff684

    • SHA1

      da6fbf78868b855451769fb1255f7c2cdef66ace

    • SHA256

      8f4c3348423dbc5dadff663216b4b015109535a06e5a81fb7cb3993a90ff26c5

    • SHA512

      f7d17b6ce23042d30d9f9bad91684e627b1f8f9bb79ec2c67c3b79791f5444a2fabdcccee48ef3335df3a262060a7300d32aa81a36a1e48fc4299b6668e91df5

    • SSDEEP

      98304:pKF6T4Y6cTie8X081BO2hVvXMtld70frtH1EOq+kYc6EPGo7v4+uT:QFrdSiekO2XvXMtld7WkYc6EC+uT

    Score
    10/10
    xmrigevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks