Overview

overview

10

Static

static

7

DFIR.exe

windows7-x64

10

DFIR.exe

windows10-2004-x64

10

Resubmissions

08-03-2024 22:18

240308-18e7asha96 10

08-03-2024 22:11

240308-134byaha27 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DFIR.pdf

  • Size

    2.8MB

  • Sample

    240308-134byaha27

  • MD5

    e372d1ba2d3a1936e3e8cdd3febf2038

  • SHA1

    06ed6e0be895945bc78adac9aa0283e50fc93349

  • SHA256

    137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9

  • SHA512

    058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70

  • SSDEEP

    49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR

Score
10/10
xmrigdiscoveryevasionminerpersistenceupx

Malware Config

Targets

    • Target

      DFIR.pdf

    • Size

      2.8MB

    • MD5

      e372d1ba2d3a1936e3e8cdd3febf2038

    • SHA1

      06ed6e0be895945bc78adac9aa0283e50fc93349

    • SHA256

      137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9

    • SHA512

      058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70

    • SSDEEP

      49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR

    Score
    10/10
    xmrigdiscoveryevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Contacts a large (20060) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks