General

  • Target

    63ce5a5c895df81cf05bd0d93f568f5d0f0008bb02c47fa0ce19af76c724cc1d.exe

  • Size

    6.5MB

  • Sample

    240518-kzg2jach4x

  • MD5

    0603ce41d19c5ed6f06d28d7c1a0d8fe

  • SHA1

    f6851bbba9127c624fb8e9993f747275bfd5e2eb

  • SHA256

    63ce5a5c895df81cf05bd0d93f568f5d0f0008bb02c47fa0ce19af76c724cc1d

  • SHA512

    2c483c352d4e9eca8f8db546e2a7014477709c320f779b24ae928bc78889ef16c784f96a9686d2d33a393dfb967aceb757dc3b2e39c708357233112d6ce02119

  • SSDEEP

    98304:L55tL6bLZNMG+8UaUPLEnSDTkGPhHeq3R3GOYG2Ou2q1pOqXu2hV2Vn3:L5rULZNt+uUjaS3kQHrWOYEutk62Vn3

Malware Config

Targets

    • Target

      63ce5a5c895df81cf05bd0d93f568f5d0f0008bb02c47fa0ce19af76c724cc1d.exe

    • Size

      6.5MB

    • MD5

      0603ce41d19c5ed6f06d28d7c1a0d8fe

    • SHA1

      f6851bbba9127c624fb8e9993f747275bfd5e2eb

    • SHA256

      63ce5a5c895df81cf05bd0d93f568f5d0f0008bb02c47fa0ce19af76c724cc1d

    • SHA512

      2c483c352d4e9eca8f8db546e2a7014477709c320f779b24ae928bc78889ef16c784f96a9686d2d33a393dfb967aceb757dc3b2e39c708357233112d6ce02119

    • SSDEEP

      98304:L55tL6bLZNMG+8UaUPLEnSDTkGPhHeq3R3GOYG2Ou2q1pOqXu2hV2Vn3:L5rULZNt+uUjaS3kQHrWOYEutk62Vn3

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks