xmrig | 852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10 | Triage

Submit
Reports

Overview

overview

Static

static

852f31b2fa...10.exe

windows7-x64

852f31b2fa...10.exe

windows10-2004-x64

Sharing

General

Target

852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10
Size

1.4MB
Sample

240522-cvhhhahe3v
MD5

d755eb790f7f3c4cf72e1bae4eabb354
SHA1

560bb78259eb4d61e026ae98e9b56623eca12374
SHA256

852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10
SHA512

f3ca5537ea9c083f56c0ca35ea31bc48c8fd3a08ed45b1bb2d5e0bb5f68e3f2da903b43bdd3ef6089709a21af37f230393b08201e5518de0deae061c20ac2486
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGR+cklyG:Lz071uv4BPMkHC0IlnASEx/Rkhlx

Score

10^/10

xmrig execution miner upx

Static task

static1

upx miner xmrig

6 signatures

Behavioral task

behavioral1

Sample

852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10.exe

Resource

win7-20240221-en

xmrig execution miner upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10.exe

Resource

win10v2004-20240508-en

xmrig execution miner upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10
- Size
  
  1.4MB
- MD5
  
  d755eb790f7f3c4cf72e1bae4eabb354
- SHA1
  
  560bb78259eb4d61e026ae98e9b56623eca12374
- SHA256
  
  852f31b2fae157d7d9da27e641587482084cda5653efa8674a2287f4fdfdca10
- SHA512
  
  f3ca5537ea9c083f56c0ca35ea31bc48c8fd3a08ed45b1bb2d5e0bb5f68e3f2da903b43bdd3ef6089709a21af37f230393b08201e5518de0deae061c20ac2486
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGR+cklyG:Lz071uv4BPMkHC0IlnASEx/Rkhlx
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2024

Terms | Privacy