xmrig | 9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

9a8da4474c...22.exe

windows7-x64

9a8da4474c...22.exe

windows10-2004-x64

Sharing

General

Target

9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022
Size

1.8MB
Sample

240709-c1fwvsthmh
MD5

9574f2c78b14d4b4be76a056b375ff3f
SHA1

37c7a9c48c8a89ef296348b6d893292fba7fdea4
SHA256

9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022
SHA512

0d4b59e8dfce9c84b288cd71204bfbe5913f4c32301e92471bc2015b28475770588180bd19f3994463610ffb0654bdea50c0ae680368a93caf0985f4014a3533
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6rdwwvi/XqwJclBVvNX0179l:Lz071uv4BPMkFfdk2afGwwvChEM1/

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Static task

static1

upx miner xmrig

4 signatures

Behavioral task

behavioral1

Sample

9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe

Resource

win7-20240704-en

xmrig execution miner persistence privilege_escalation upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022.exe

Resource

win10v2004-20240704-en

xmrig execution miner upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022
- Size
  
  1.8MB
- MD5
  
  9574f2c78b14d4b4be76a056b375ff3f
- SHA1
  
  37c7a9c48c8a89ef296348b6d893292fba7fdea4
- SHA256
  
  9a8da4474c9e97f24a425d08d561e3ee554e74668ad9db5ac23de253ca312022
- SHA512
  
  0d4b59e8dfce9c84b288cd71204bfbe5913f4c32301e92471bc2015b28475770588180bd19f3994463610ffb0654bdea50c0ae680368a93caf0985f4014a3533
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6rdwwvi/XqwJclBVvNX0179l:Lz071uv4BPMkFfdk2afGwwvChEM1/
Score

10^/10

xmrig execution miner persistence privilege_escalation upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Accessibility Features

Privilege Escalation

Event Triggered Execution

Accessibility Features

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerpersistenceprivilege_escalationupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy