General

  • Target

    09271a338ed85a96c6431fc9cb821720N.exe

  • Size

    1.8MB

  • Sample

    240708-1hhjqszerr

  • MD5

    09271a338ed85a96c6431fc9cb821720

  • SHA1

    e2c3e9a7629c751cebe809791442ac5cf56b29d5

  • SHA256

    05021dc1b621144bdbe39711a0bd9bcc42d3aca24ec1ee02c8b1badb362ca603

  • SHA512

    c31028b18012be79cbc830904eb0a79509aa89e1b1d1707cf15cfd9f95e3fe4feb772118d3e403f2df902d5f6fd940c81045a93d83d3dc509aa70babfefa39da

  • SSDEEP

    49152:Lz071uv4BPMkHC0IlnASEx/z+cl8WNG/Wnqnc:NABt

Malware Config

Targets

    • Target

      09271a338ed85a96c6431fc9cb821720N.exe

    • Size

      1.8MB

    • MD5

      09271a338ed85a96c6431fc9cb821720

    • SHA1

      e2c3e9a7629c751cebe809791442ac5cf56b29d5

    • SHA256

      05021dc1b621144bdbe39711a0bd9bcc42d3aca24ec1ee02c8b1badb362ca603

    • SHA512

      c31028b18012be79cbc830904eb0a79509aa89e1b1d1707cf15cfd9f95e3fe4feb772118d3e403f2df902d5f6fd940c81045a93d83d3dc509aa70babfefa39da

    • SSDEEP

      49152:Lz071uv4BPMkHC0IlnASEx/z+cl8WNG/Wnqnc:NABt

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks