General

  • Target

    Update.exe

  • Size

    8.1MB

  • Sample

    240628-dm4w7s1blm

  • MD5

    91e2035f6aae7bf27732d8313d4a75f4

  • SHA1

    1dfc1ff6cc6a5772ffac5915097810f0f4a9a27c

  • SHA256

    9e833da741268e4506b2f283d81e5d2c1a80ead5bde52845aa727cf7278cd706

  • SHA512

    4962b64b8990efffa54f256f3170ccc483a680502505373ebea424bed3a2c4e4f07731cff2c2a7745ce28e48ff0c0783de5ec8b6328489c52a3375e552dedea7

  • SSDEEP

    196608:4eyFcK/kyQhZeN/FJMIDJf0gsAGK4RpuUDB:0/nQhK/Fqyf0gstpuW

Malware Config

Targets

    • Target

      Update.exe

    • Size

      8.1MB

    • MD5

      91e2035f6aae7bf27732d8313d4a75f4

    • SHA1

      1dfc1ff6cc6a5772ffac5915097810f0f4a9a27c

    • SHA256

      9e833da741268e4506b2f283d81e5d2c1a80ead5bde52845aa727cf7278cd706

    • SHA512

      4962b64b8990efffa54f256f3170ccc483a680502505373ebea424bed3a2c4e4f07731cff2c2a7745ce28e48ff0c0783de5ec8b6328489c52a3375e552dedea7

    • SSDEEP

      196608:4eyFcK/kyQhZeN/FJMIDJf0gsAGK4RpuUDB:0/nQhK/Fqyf0gstpuW

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Creates new service(s)

    • Stops running service(s)

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks