Overview

overview

10

Static

static

1

tesy - Copy (10).bat

windows10-1703-x64

10

tesy - Copy (11).bat

windows10-1703-x64

10

tesy - Copy (12).bat

windows10-1703-x64

10

tesy - Copy (13).bat

windows10-1703-x64

10

tesy - Copy (14).bat

windows10-1703-x64

10

tesy - Copy (2).bat

windows10-1703-x64

10

tesy - Copy (3).bat

windows10-1703-x64

10

tesy - Copy (4).bat

windows10-1703-x64

10

tesy - Copy (5).bat

windows10-1703-x64

10

tesy - Copy (6).bat

windows10-1703-x64

10

tesy - Copy (7).bat

windows10-1703-x64

10

tesy - Copy (8).bat

windows10-1703-x64

10

tesy - Copy (9).bat

windows10-1703-x64

10

tesy - Copy.bat

windows10-1703-x64

10

tesy.bat

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NM.zip
  • Size 8KB
  • Sample240101-dppkasdcf5
  • SHA256 04cf0194fb37bcc19b2b63904d84a74c720b64b7938620fdf971bb98a8f47ccd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigminer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip

Targets

    • Target
      tesy - Copy (10).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral1
    • Target
      tesy - Copy (11).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral2
    • Target
      tesy - Copy (12).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral3
    • Target
      tesy - Copy (13).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral4
    • Target
      tesy - Copy (14).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral5
    • Target
      tesy - Copy (2).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral6
    • Target
      tesy - Copy (3).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral7
    • Target
      tesy - Copy (4).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral8
    • Target
      tesy - Copy (5).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral9
    • Target
      tesy - Copy (6).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral10
    • Target
      tesy - Copy (7).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral11
    • Target
      tesy - Copy (8).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral12
    • Target
      tesy - Copy (9).bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral13
    • Target
      tesy - Copy.bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral14
    • Target
      tesy.bat
    • Size 608B
    • SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral15

MITRE ATT&CK Matrix

Tasks