Overview

overview

10

Static

static

10

8e4fdbd766...55.exe

windows7-x64

10

8e4fdbd766...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e4fdbd766237e11f07ad2c9244376728616af559b676e4112e7f4d55da2d155

  • Size

    1.6MB

  • Sample

    240522-dfswcsab53

  • MD5

    0a472e4bdd8d288dd5217e6de55b6df1

  • SHA1

    2e62652dbe7b5d14e48adc67eb5f0b8a72b3a6b4

  • SHA256

    8e4fdbd766237e11f07ad2c9244376728616af559b676e4112e7f4d55da2d155

  • SHA512

    4a47ed24f158dca4605d64f433b8a23ab5bbb18a484a2fc32c5b9a58a26d01ba806f09b8a6e3ca14a5e25dd820cd5ba2f0c8c02d48c9058d594e3e33a011a4b9

  • SSDEEP

    24576:JanwhSe11QSONCpGJCjETPlia+zzDwD/YCgU+Lqq6a9xyCyt0RCciNHV2mZuDcoY:knw9oUUEEDlnDwq6Sd0R7qV2Y9i8

Score
10/10
xmrigminerpersistenceupx

Malware Config

Targets

    • Target

      8e4fdbd766237e11f07ad2c9244376728616af559b676e4112e7f4d55da2d155

    • Size

      1.6MB

    • MD5

      0a472e4bdd8d288dd5217e6de55b6df1

    • SHA1

      2e62652dbe7b5d14e48adc67eb5f0b8a72b3a6b4

    • SHA256

      8e4fdbd766237e11f07ad2c9244376728616af559b676e4112e7f4d55da2d155

    • SHA512

      4a47ed24f158dca4605d64f433b8a23ab5bbb18a484a2fc32c5b9a58a26d01ba806f09b8a6e3ca14a5e25dd820cd5ba2f0c8c02d48c9058d594e3e33a011a4b9

    • SSDEEP

      24576:JanwhSe11QSONCpGJCjETPlia+zzDwD/YCgU+Lqq6a9xyCyt0RCciNHV2mZuDcoY:knw9oUUEEDlnDwq6Sd0R7qV2Y9i8

    Score
    10/10
    xmrigminerupxpersistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • UPX dump on OEP (original entry point)

    • XMRig Miner payload

      miner

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks