xmrig

General

Target

03cdea89812619cd414bb726ed64cd32_JaffaCakes118
Size

1.9MB
Sample

240427-2rvfbsaf41
MD5

03cdea89812619cd414bb726ed64cd32
SHA1

18eccf93c105491502b78eb2a9b01f86cf36c72c
SHA256

c005445dc6911ec8ade0ebfaa7743292e9cfe6764917079089774184f5485d0e
SHA512

5c7bdb6f3e3ac0dcf78542116679773534e19f390d5cdab11ca8a9bdf01f1b35fbcee75c0fe555e2385f9918315c8f7b3b224cbb1a045abddee008d8eb80f979
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UO+:NABu

Score

10^/10

Malware Config

Targets

- Target
  
  03cdea89812619cd414bb726ed64cd32_JaffaCakes118
- Size
  
  1.9MB
- MD5
  
  03cdea89812619cd414bb726ed64cd32
- SHA1
  
  18eccf93c105491502b78eb2a9b01f86cf36c72c
- SHA256
  
  c005445dc6911ec8ade0ebfaa7743292e9cfe6764917079089774184f5485d0e
- SHA512
  
  5c7bdb6f3e3ac0dcf78542116679773534e19f390d5cdab11ca8a9bdf01f1b35fbcee75c0fe555e2385f9918315c8f7b3b224cbb1a045abddee008d8eb80f979
- SSDEEP
  
  49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UO+:NABu
Score

10^/10

xmrig miner upx
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

XMRig Miner payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2