Overview

overview

10

Static

static

1

1.bat

windows10-1703-x64

10

10.bat

windows10-1703-x64

10

11.bat

windows10-1703-x64

10

12.bat

windows10-1703-x64

10

13.bat

windows10-1703-x64

10

14.bat

windows10-1703-x64

10

15.bat

windows10-1703-x64

10

2.bat

windows10-1703-x64

10

3.bat

windows10-1703-x64

10

4.bat

windows10-1703-x64

10

5.bat

windows10-1703-x64

10

6.bat

windows10-1703-x64

10

7.bat

windows10-1703-x64

10

8.bat

windows10-1703-x64

10

9.bat

windows10-1703-x64

10

Resubmissions

20/05/2024, 21:25

240520-z9xx3age89

20/05/2024, 21:17

240520-z5gehsge39

20/05/2024, 21:17

240520-z43alage37

20/05/2024, 21:16

240520-z4m6nsha7t

20/05/2024, 21:15

240520-z39chsge24

20/05/2024, 21:15

240520-z3t8lagd95

20/05/2024, 21:14

240520-z3e4nsha6s

20/05/2024, 21:13

240520-z22ahsgd87

20/05/2024, 21:12

240520-z2l6laha5t

20/05/2024, 21:12

240520-z18cfagd78

Sharing

Copy URL Twitter E-mail

General

  • Target
    15.zip
  • Size 7KB
  • Sample240520-vpdapsag41
  • SHA256 c0768ace239b9f133dfbb33d830ff9bf0580b167e2a6b0f015950f7aa2b1f768
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigexecutionminer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-msvc-win64.zip

Targets

    • Target
      1.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral1
    • Target
      10.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral2
    • Target
      11.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral3
    • Target
      12.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral4
    • Target
      13.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral5
    • Target
      14.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral6
    • Target
      15.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral7
    • Target
      2.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral8
    • Target
      3.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral9
    • Target
      4.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral10
    • Target
      5.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral11
    • Target
      6.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral12
    • Target
      7.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral13
    • Target
      8.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral14
    • Target
      9.bat
    • Size 599B
    • SHA256 f83d724987f9f4a0843c0b0abd01f3f5ceccbc8e7babad76c2639e1bef2fee07
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral15

MITRE ATT&CK Enterprise v15

Tasks