xmrig

General

Target

Updater.exe
Size

9.2MB
Sample

240716-yxwzka1bqd
MD5

4ab8ccecd4a134b37a1141b515371b66
SHA1

d0ebd671b85d91b7e4405e78dc8de723c23ee99d
SHA256

7059ff79287dcb1ead0d9b0a166bc551d729b1c7c412cecab3574ac1379685f8
SHA512

249ed30e142530b006958605f9f31f6d9fcf39b412e4ef1b2040887ed7020363749ce89150c4c35a3b4a92a7e6955775dc9f7c0246034fe18909c39bdb121ecd
SSDEEP

196608:cezNzOtuVXR6GWycUnkD8/04pUh76TBFx:ce5XBWycUnkD8/jps7cB

Score

10^/10

Malware Config

Targets

- Target
  
  Updater.exe
- Size
  
  9.2MB
- MD5
  
  4ab8ccecd4a134b37a1141b515371b66
- SHA1
  
  d0ebd671b85d91b7e4405e78dc8de723c23ee99d
- SHA256
  
  7059ff79287dcb1ead0d9b0a166bc551d729b1c7c412cecab3574ac1379685f8
- SHA512
  
  249ed30e142530b006958605f9f31f6d9fcf39b412e4ef1b2040887ed7020363749ce89150c4c35a3b4a92a7e6955775dc9f7c0246034fe18909c39bdb121ecd
- SSDEEP
  
  196608:cezNzOtuVXR6GWycUnkD8/04pUh76TBFx:ce5XBWycUnkD8/jps7cB
Score

10^/10

xmrig evasion execution miner persistence upx vmprotect
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2