xmrig | 2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596 | Triage

Submit
Reports

Overview

overview

Static

static

2bb3309ed5...96.exe

windows7-x64

2bb3309ed5...96.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596
Size

1.7MB
Sample

240527-y2m78agg3t
MD5

d31b14e884783a7f3f7102df767d022b
SHA1

035efb85ccc9470661e707b32d55d989769421e7
SHA256

2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596
SHA512

1fbfdbd49ff292b66b20f659a00c4fcedb2f5dc342467293cdee5db177117fdb44dad01a5a70b6887d9966eb53505e4b6f02cca37175cb6e3bbe594b1ecd8faf
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupQF4g6FReQwUzN6Rf0jEZ:Lz071uv4BPMki8CnfZFOzwZ

Score

10^/10

xmrig execution miner upx

Static task

static1

upx miner xmrig

6 signatures

Behavioral task

behavioral1

Sample

2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596.exe

Resource

win7-20240221-en

xmrig execution miner upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596.exe

Resource

win10v2004-20240426-en

xmrig execution miner upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596
- Size
  
  1.7MB
- MD5
  
  d31b14e884783a7f3f7102df767d022b
- SHA1
  
  035efb85ccc9470661e707b32d55d989769421e7
- SHA256
  
  2bb3309ed58f15c0ebb08c1aa934a1efd72386351aca2d9865493b63b7f62596
- SHA512
  
  1fbfdbd49ff292b66b20f659a00c4fcedb2f5dc342467293cdee5db177117fdb44dad01a5a70b6887d9966eb53505e4b6f02cca37175cb6e3bbe594b1ecd8faf
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupQF4g6FReQwUzN6Rf0jEZ:Lz071uv4BPMki8CnfZFOzwZ
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy