Overview

overview

10

Static

static

10

3620fba24a...65.exe

windows7-x64

10

3620fba24a...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3620fba24a1c7b1bcb196b64da1c19071062bb0c4cbe4d07fd8fbb564a6e6e65

  • Size

    2.0MB

  • Sample

    240710-z298eszgmn

  • MD5

    30262072a3bd143b80061819fa4907ac

  • SHA1

    0751e1354969fa9311d5ef6684210a8316390403

  • SHA256

    3620fba24a1c7b1bcb196b64da1c19071062bb0c4cbe4d07fd8fbb564a6e6e65

  • SHA512

    5e479db0d1c3f5b583d20e4fde9b7effe7a2642f86b854ab153aa7f5ab5710640c34680c3ab5a36d0db319acf8d1ec112601b89eafad356f35bbd82adc751c36

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boD:Lz071uv4BPMkiFGlObO11jB7FZPU

Score
10/10
xmrigexecutionminerpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      3620fba24a1c7b1bcb196b64da1c19071062bb0c4cbe4d07fd8fbb564a6e6e65

    • Size

      2.0MB

    • MD5

      30262072a3bd143b80061819fa4907ac

    • SHA1

      0751e1354969fa9311d5ef6684210a8316390403

    • SHA256

      3620fba24a1c7b1bcb196b64da1c19071062bb0c4cbe4d07fd8fbb564a6e6e65

    • SHA512

      5e479db0d1c3f5b583d20e4fde9b7effe7a2642f86b854ab153aa7f5ab5710640c34680c3ab5a36d0db319acf8d1ec112601b89eafad356f35bbd82adc751c36

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boD:Lz071uv4BPMkiFGlObO11jB7FZPU

    Score
    10/10
    xmrigexecutionminerupxpersistenceprivilege_escalation

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks