General
-
Target
11017156638847.bat
-
Size
517B
-
Sample
240630-m2ys6swgph
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Static task
static1
Behavioral task
behavioral1
Sample
11017156638847.bat
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
11017156638847.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
11017156638847.bat
Resource
win11-20240508-en
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://github.com/xmrig/xmrig/releases/latest
Extracted
https://github.comDownloadString
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Targets
-
-
Target
11017156638847.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
-
XMRig Miner payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-