xmrig | 44873eb5eb2117feff648571cce3503b21522beadafc2c7b64d8af9caca5a8dc | Triage

Submit
Reports

Overview

overview

Static

static

3

4f1c5c4fe8...c2.exe

windows7-x64

4f1c5c4fe8...c2.exe

windows10-2004-x64

Sharing

General

Target

4f1c5c4fe87d7e64466afd1850aeb0c2
Size

4.1MB
Sample

240110-axcnxsaebm
MD5

4f1c5c4fe87d7e64466afd1850aeb0c2
SHA1

9256f3a6c36a7dc265555795d6a4f28e97b1aeb3
SHA256

44873eb5eb2117feff648571cce3503b21522beadafc2c7b64d8af9caca5a8dc
SHA512

2356aa91ea1e372de57fec2f3f28902c2c5bddabdb638ffd1bc582eba9cd2f683a7724691de4b2fb55dbfa0cdda66bea1bba981f7984fc3667476055d88155b4
SSDEEP

98304:3ftEAoiH6sp7l5qZiTs0nrwbB9oaNLcGlk+hHOfMVzdQqII:3JqCsxbB9oMLcB+hTxdj

Score

10^/10

xmrig evasion miner persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4f1c5c4fe87d7e64466afd1850aeb0c2.exe

Resource

win7-20231215-en

xmrig evasion miner persistence trojan

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

4f1c5c4fe87d7e64466afd1850aeb0c2.exe

Resource

win10v2004-20231215-en

xmrig evasion miner persistence trojan

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  4f1c5c4fe87d7e64466afd1850aeb0c2
- Size
  
  4.1MB
- MD5
  
  4f1c5c4fe87d7e64466afd1850aeb0c2
- SHA1
  
  9256f3a6c36a7dc265555795d6a4f28e97b1aeb3
- SHA256
  
  44873eb5eb2117feff648571cce3503b21522beadafc2c7b64d8af9caca5a8dc
- SHA512
  
  2356aa91ea1e372de57fec2f3f28902c2c5bddabdb638ffd1bc582eba9cd2f683a7724691de4b2fb55dbfa0cdda66bea1bba981f7984fc3667476055d88155b4
- SSDEEP
  
  98304:3ftEAoiH6sp7l5qZiTs0nrwbB9oaNLcGlk+hHOfMVzdQqII:3JqCsxbB9oMLcB+hTxdj
Score

10^/10

xmrig evasion miner persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- XMRig Miner payload
  miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigevasionminerpersistencetrojan

behavioral2

xmrigevasionminerpersistencetrojan

© 2018-2025

Terms | Privacy