xmrig | 84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808 | Triage

Submit
Reports

Overview

overview

Static

static

84faf66d51...08.exe

windows7-x64

84faf66d51...08.exe

windows10-2004-x64

Sharing

General

Target

84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808
Size

3.0MB
Sample

240522-cs3qnahd71
MD5

a5b448e97d2bfbcccf6c95879bbf5bed
SHA1

5891a227db139a409fb474a648997af276aa4d06
SHA256

84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808
SHA512

0a6f1773c95e09fa1997a70fcd6d5799b5e41233e8ef6cf3426128fbf800a3bdc888de24cff5b060621c919f78772ae5141ab4d30c42a912e506b1711555927d
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsIRSwV74:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3

Score

10^/10

xmrig execution miner upx

Static task

static1

miner upx xmrig

6 signatures

Behavioral task

behavioral1

Sample

84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808.exe

Resource

win7-20240215-en

xmrig execution miner upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808.exe

Resource

win10v2004-20240508-en

xmrig execution miner upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808
- Size
  
  3.0MB
- MD5
  
  a5b448e97d2bfbcccf6c95879bbf5bed
- SHA1
  
  5891a227db139a409fb474a648997af276aa4d06
- SHA256
  
  84faf66d51762452271f64d9f0c8b9110f8c5f4436f1e18a60b08c0a28c02808
- SHA512
  
  0a6f1773c95e09fa1997a70fcd6d5799b5e41233e8ef6cf3426128fbf800a3bdc888de24cff5b060621c919f78772ae5141ab4d30c42a912e506b1711555927d
- SSDEEP
  
  49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsIRSwV74:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2024

Terms | Privacy