xmrig | be8f36c37ce2d5dd3500d9fc79367fa4cbdc259cb816de78d010359db525d2d2 | Triage

Submit
Reports

Overview

overview

Static

static

43818f3563...0N.exe

windows7-x64

43818f3563...0N.exe

windows10-2004-x64

Sharing

General

Target

43818f356317a3fdaf9c4740c25fe070N.exe
Size

1.6MB
Sample

240726-xlsmbs1fje
MD5

43818f356317a3fdaf9c4740c25fe070
SHA1

9297178a00b4475dbbd153e0980852487a36d68e
SHA256

be8f36c37ce2d5dd3500d9fc79367fa4cbdc259cb816de78d010359db525d2d2
SHA512

70dfbe26c21603dd48a513eb03dd7678a5e0713544b69e0fa483df8a78620c27e3cf8c7f05daf2fa3544d5b9321807836ae28097dceee4478cf3a8b0655dc501
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTnHzlyPGkd+TKqxxLV:Lz071uv4BPMkFfdk2auTlGGxZ

Score

10^/10

xmrig discovery execution miner persistence privilege_escalation upx

Static task

static1

upx miner xmrig

4 signatures

Behavioral task

behavioral1

Sample

43818f356317a3fdaf9c4740c25fe070N.exe

Resource

win7-20240704-en

xmrig execution miner persistence privilege_escalation upx

windows7-x64

11 signatures

120 seconds

Behavioral task

behavioral2

Sample

43818f356317a3fdaf9c4740c25fe070N.exe

Resource

win10v2004-20240709-en

xmrig discovery execution miner upx

windows10-2004-x64

13 signatures

120 seconds

Malware Config

Targets

- Target
  
  43818f356317a3fdaf9c4740c25fe070N.exe
- Size
  
  1.6MB
- MD5
  
  43818f356317a3fdaf9c4740c25fe070
- SHA1
  
  9297178a00b4475dbbd153e0980852487a36d68e
- SHA256
  
  be8f36c37ce2d5dd3500d9fc79367fa4cbdc259cb816de78d010359db525d2d2
- SHA512
  
  70dfbe26c21603dd48a513eb03dd7678a5e0713544b69e0fa483df8a78620c27e3cf8c7f05daf2fa3544d5b9321807836ae28097dceee4478cf3a8b0655dc501
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTnHzlyPGkd+TKqxxLV:Lz071uv4BPMkFfdk2auTlGGxZ
Score

10^/10

xmrig execution miner persistence privilege_escalation upx discovery
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Accessibility Features

Privilege Escalation

Event Triggered Execution

Accessibility Features

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerpersistenceprivilege_escalationupx

behavioral2

xmrigdiscoveryexecutionminerupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.