Overview

overview

10

Static

static

1

17345146774282.bat

windows10-1703-x64

10

17345146774282.bat

windows10-2004-x64

10

17345146774282.bat

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    17345146774282.bat
  • Size 517B
  • Sample240630-yn8a8stelf
  • SHA256 4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
  • MD5 SHA1 SHA512
Score
10/10
xmrigevasionexecutionminer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://rentry.co/regele/raw

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Targets

    • Target
      17345146774282.bat
    • Size 517B
    • SHA256 4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
    • MD5 SHA1 SHA512
    Score
    10/10
    xmrigevasionexecutionminer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Blocklisted process makes network request

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks