xmrig

General

Target

006bb5643bd5b4eefdf153a43139634f_JaffaCakes118
Size

2.1MB
Sample

240426-kv7fmada96
MD5

006bb5643bd5b4eefdf153a43139634f
SHA1

f9a1f26f78b54deaf0c258d44cb3ed5cffd3db99
SHA256

e18d52f7f8cd8113c7af2056d4c4528e52ead13924c8ca049cdbb9d2d55df3cb
SHA512

dd9474b28c7d1376f6618ba2fbab60906c7e04e24b71ff209bbc77964362edd4da528d8bf8785d32a9b79021781f1504cd08cb89dc18c8637755cbba9fd8c150
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMH:NABP

Score

10^/10

Malware Config

Targets

- Target
  
  006bb5643bd5b4eefdf153a43139634f_JaffaCakes118
- Size
  
  2.1MB
- MD5
  
  006bb5643bd5b4eefdf153a43139634f
- SHA1
  
  f9a1f26f78b54deaf0c258d44cb3ed5cffd3db99
- SHA256
  
  e18d52f7f8cd8113c7af2056d4c4528e52ead13924c8ca049cdbb9d2d55df3cb
- SHA512
  
  dd9474b28c7d1376f6618ba2fbab60906c7e04e24b71ff209bbc77964362edd4da528d8bf8785d32a9b79021781f1504cd08cb89dc18c8637755cbba9fd8c150
- SSDEEP
  
  49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMH:NABP
Score

10^/10

xmrig miner upx
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

XMRig Miner payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2