Overview

overview

10

Static

static

1

vers1.bat

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vers1.bat

  • Size

    329B

  • Sample

    240625-vj22wavdjm

  • MD5

    77d59dcc9fd11db5ecdd3e67bcc0e7ea

  • SHA1

    9e0a63f9f5441a101cb61354695514206c757be5

  • SHA256

    ac4ec1f0338085cf15f076212941130b1d31cd81b77a1c4b88ecf727334ac6da

  • SHA512

    6dc2657454821281c5f51a7d5d863387bd05ea0346c703178cf66dafbb09dcd8bb9895d96f1dbf370b1f8369b73a4a8ac22055994a45aa3695e7cbadfff6d14f

Score
10/10
xmrigevasionexecutionminer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://rentry.co/regele/raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Targets

    • Target

      vers1.bat

    • Size

      329B

    • MD5

      77d59dcc9fd11db5ecdd3e67bcc0e7ea

    • SHA1

      9e0a63f9f5441a101cb61354695514206c757be5

    • SHA256

      ac4ec1f0338085cf15f076212941130b1d31cd81b77a1c4b88ecf727334ac6da

    • SHA512

      6dc2657454821281c5f51a7d5d863387bd05ea0346c703178cf66dafbb09dcd8bb9895d96f1dbf370b1f8369b73a4a8ac22055994a45aa3695e7cbadfff6d14f

    Score
    10/10
    xmrigevasionexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks