xmrig

Target

61b322051908949b1fe40f5ab5995cec4c2f1abb6628e5f798cab8a91f42d0e3.exe
Size

16.0MB
Sample

240229-f59xaafe58
MD5

b8e2ec7d64fe3156c5f684b3a2757301
SHA1

565db0f626a875be0ba5234963727e45c01f3ca9
SHA256

61b322051908949b1fe40f5ab5995cec4c2f1abb6628e5f798cab8a91f42d0e3
SHA512

02894d45ddeb98471ce09a99e3b4fe6e23b03e17c77ffba31d6a5e58b2a3b17eba3f8c8b81988b82aacca385ecc6dc752aa1ed62681909ff3d67acaf56a697d6
SSDEEP

393216:OccUL96juOB/a7LOupqeRbz9rmGuXrERtpyw7c+AiT:FZJkazpqeRbrdZyAc+Ai

Score

10^/10

xmrig miner

Malware Config

Targets

- Target
  
  61b322051908949b1fe40f5ab5995cec4c2f1abb6628e5f798cab8a91f42d0e3.exe
- Size
  
  16.0MB
- MD5
  
  b8e2ec7d64fe3156c5f684b3a2757301
- SHA1
  
  565db0f626a875be0ba5234963727e45c01f3ca9
- SHA256
  
  61b322051908949b1fe40f5ab5995cec4c2f1abb6628e5f798cab8a91f42d0e3
- SHA512
  
  02894d45ddeb98471ce09a99e3b4fe6e23b03e17c77ffba31d6a5e58b2a3b17eba3f8c8b81988b82aacca385ecc6dc752aa1ed62681909ff3d67acaf56a697d6
- SSDEEP
  
  393216:OccUL96juOB/a7LOupqeRbz9rmGuXrERtpyw7c+AiT:FZJkazpqeRbrdZyAc+Ai
Score

10^/10

xmrig miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

XMRig Miner payload

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2