Overview

overview

10

Static

static

3

grhsghsGHs...y8.exe

windows7-x64

10

grhsghsGHs...y8.exe

windows10-2004-x64

10

grhsghsGHs...SE.exe

windows7-x64

10

grhsghsGHs...SE.exe

windows10-2004-x64

10

grhsghsGHs...CD.exe

windows7-x64

10

grhsghsGHs...CD.exe

windows10-2004-x64

10

grhsghsGHs...Da.exe

windows7-x64

10

grhsghsGHs...Da.exe

windows10-2004-x64

10

grhsghsGHs...wq.exe

windows7-x64

10

grhsghsGHs...wq.exe

windows10-2004-x64

10

grhsghsGHs...r7.exe

windows7-x64

10

grhsghsGHs...r7.exe

windows10-2004-x64

10

grhsghsGHs...XJ.exe

windows7-x64

10

grhsghsGHs...XJ.exe

windows10-2004-x64

10

grhsghsGHs...eg.exe

windows7-x64

10

grhsghsGHs...eg.exe

windows10-2004-x64

10

grhsghsGHs...5H.exe

windows7-x64

10

grhsghsGHs...5H.exe

windows10-2004-x64

10

grhsghsGHs...XN.exe

windows7-x64

10

grhsghsGHs...XN.exe

windows10-2004-x64

10

grhsghsGHs...T3.exe

windows7-x64

10

grhsghsGHs...T3.exe

windows10-2004-x64

10

grhsghsGHs...9r.exe

windows7-x64

10

grhsghsGHs...9r.exe

windows10-2004-x64

10

grhsghsGHs...GR.exe

windows7-x64

10

grhsghsGHs...GR.exe

windows10-2004-x64

10

grhsghsGHs...EX.exe

windows7-x64

10

grhsghsGHs...EX.exe

windows10-2004-x64

10

grhsghsGHs...EA.exe

windows7-x64

10

grhsghsGHs...EA.exe

windows10-2004-x64

10

grhsghsGHs...FB.exe

windows7-x64

10

grhsghsGHs...FB.exe

windows10-2004-x64

10

Resubmissions

25-01-2024 16:55

240125-vfcyksbhgr 10

24-01-2024 17:15

240124-vstf4aecaj 10

23-01-2024 19:27

240123-x6cfvagbd9 10

23-01-2024 19:27

240123-x6bvbafgem 10

23-01-2024 19:27

240123-x6bjjsgbd8 10

23-01-2024 19:27

240123-x6ax1sfgek 10

23-01-2024 19:27

240123-x6abgsfgej 10

23-01-2024 19:27

240123-x591qagbd7 10

23-01-2024 19:27

240123-x59d7agbd6 10

23-01-2024 19:27

240123-x584esgbd5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    grhsghsGHswghs.zip

  • Size

    53.3MB

  • Sample

    240124-vstf4aecaj

  • MD5

    533ca99ff496fe94384e08be4543ece9

  • SHA1

    23e9ac7eb659a166959856a04d5c124721df2a38

  • SHA256

    165a0de3cbb54178e47215a0ad412c91f1cbbcefc3c3d35d8124c5972d1c1950

  • SHA512

    c6155011159aa102d681d8c5aa19dde57dbe1fe3fea68670d41dddd07fb1204f0c5d9951c1d65085acf93a78732fed037581fcbbc597143f59ae25d4ffc76c8c

  • SSDEEP

    1572864:HS7A5V1y7xaCcUHNsUZ04Wp3xWytXPDg+yS03gXn4yu:HSkL1yPXW1p3D0SLX4N

Score
10/10
kinsingxmrigloaderminerupx

Malware Config

Targets

    • Target

      grhsghsGHswgh/3JynzWc6LxNCT2y8.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      grhsghsGHswgh/6aNn9vLJCQVfagSE.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      grhsghsGHswgh/6vHkJ4UErTSS5ECD.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

    • Target

      grhsghsGHswgh/Be5sCbvuma2nkHDa.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral7behavioral8

    • Target

      grhsghsGHswgh/DLKFnAGYJBNTnxwq.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    kinsingxmrigloaderminerupx

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral10behavioral9

    • Target

      grhsghsGHswgh/EtPLMpbCyFJpMJr7.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral11behavioral12

    • Target

      grhsghsGHswgh/Gu3PdXt79NF7EJXJ.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral13behavioral14

    • Target

      grhsghsGHswgh/JqLvG94UkYjhxAeg.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral15behavioral16

    • Target

      grhsghsGHswgh/LM3BR4UBmKBzBP5H.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral17behavioral18

    • Target

      grhsghsGHswgh/M8xUNW42QxTLMRXN.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral19behavioral20

    • Target

      grhsghsGHswgh/Q5EUCWHU7pMYBfT3.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral21behavioral22

    • Target

      grhsghsGHswgh/UMRsPGc4u9tycx9r.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral23behavioral24

    • Target

      grhsghsGHswgh/UU4Ddwqm5zcuLzGR.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral25behavioral26

    • Target

      grhsghsGHswgh/XJEzW6M7WvHaF3EX.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral27behavioral28

    • Target

      grhsghsGHswgh/Y2JYGshMHJGuGREA.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral29behavioral30

    • Target

      grhsghsGHswgh/Yvdp8t5knpQz7sFB.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

16
T1053

Persistence

Scheduled Task/Job

16
T1053

Privilege Escalation

Scheduled Task/Job

16
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

16
T1082

Query Registry

16
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

xmrigminerupx
Score
10/10

behavioral2

kinsingxmrigloaderminerupx
Score
10/10

behavioral3

xmrigminerupx
Score
10/10

behavioral4

kinsingxmrigloaderminerupx
Score
10/10

behavioral5

xmrigminerupx
Score
10/10

behavioral6

kinsingxmrigloaderminerupx
Score
10/10

behavioral7

xmrigminerupx
Score
10/10

behavioral8

kinsingxmrigloaderminerupx
Score
10/10

behavioral9

xmrigminerupx
Score
10/10

behavioral10

kinsingxmrigloaderminerupx
Score
10/10

behavioral11

xmrigminerupx
Score
10/10

behavioral12

kinsingxmrigloaderminerupx
Score
10/10

behavioral13

xmrigminerupx
Score
10/10

behavioral14

kinsingxmrigloaderminerupx
Score
10/10

behavioral15

xmrigminerupx
Score
10/10

behavioral16

xmrigminerupx
Score
10/10

behavioral17

xmrigminerupx
Score
10/10

behavioral18

xmrigminerupx
Score
10/10

behavioral19

xmrigminerupx
Score
10/10

behavioral20

xmrigminerupx
Score
10/10

behavioral21

xmrigminerupx
Score
10/10

behavioral22

xmrigminerupx
Score
10/10

behavioral23

xmrigminerupx
Score
10/10

behavioral24

xmrigminerupx
Score
10/10

behavioral25

xmrigminerupx
Score
10/10

behavioral26

xmrigminerupx
Score
10/10

behavioral27

xmrigminerupx
Score
10/10

behavioral28

xmrigminerupx
Score
10/10

behavioral29

xmrigminerupx
Score
10/10

behavioral30

xmrigminerupx
Score
10/10

behavioral31

xmrigminerupx
Score
10/10

behavioral32

xmrigminerupx
Score
10/10