xmrig | 872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

872938776a...29.exe

windows7-x64

872938776a...29.exe

windows10-2004-x64

Sharing

General

Target

872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29
Size

1.7MB
Sample

240528-an5y4sgf53
MD5

f020769b01e079c05ba21885fad0da2b
SHA1

2b9ac6aeeb7e0720388b27b21f3e87cc8c59261f
SHA256

872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29
SHA512

4516bffe8e19679e661526f9f4a926a9b3c2c029f542b40122eae9b733bcc1ea16ce34a45e979da9f0a087f8603c59e8b167e103bbe11b2679111eb927345a93
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7K6WefmedkVoMCr2:Lz071uv4BPMkyW10/w16BvZuaXj2

Score

10^/10

xmrig execution miner upx

Static task

static1

upx miner xmrig

6 signatures

Behavioral task

behavioral1

Sample

872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29.exe

Resource

win7-20240221-en

xmrig execution miner upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29.exe

Resource

win10v2004-20240508-en

xmrig execution miner upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29
- Size
  
  1.7MB
- MD5
  
  f020769b01e079c05ba21885fad0da2b
- SHA1
  
  2b9ac6aeeb7e0720388b27b21f3e87cc8c59261f
- SHA256
  
  872938776a3f25ca4953c17d88f01b64f8291f43de2995940546dfb6a90c8e29
- SHA512
  
  4516bffe8e19679e661526f9f4a926a9b3c2c029f542b40122eae9b733bcc1ea16ce34a45e979da9f0a087f8603c59e8b167e103bbe11b2679111eb927345a93
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7K6WefmedkVoMCr2:Lz071uv4BPMkyW10/w16BvZuaXj2
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy