Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0

  • Size

    3.3MB

  • Sample

    240805-pywwhswejn

  • MD5

    e211b2b230ef040fe40bc380899990fc

  • SHA1

    fe36dbf3efa775193b82ce03d1b329d3feced487

  • SHA256

    666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0

  • SHA512

    d8e52248278898617e42afe93171f4400612b37b596c8fef5d7f7d98a217a1f8ff86414a4f9e567d316980309a4e8d98050877dcef139f24cb77c85764d979a3

  • SSDEEP

    49152:IpMb87gil2wlWJDddoneZxq03EjlI+pOZjlx+o1Mj+6001YP:9bZRE4+Kr60n

Score
10/10
xmrigevasionminerpersistencetrojan

Malware Config

Targets

    • Target

      666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0

    • Size

      3.3MB

    • MD5

      e211b2b230ef040fe40bc380899990fc

    • SHA1

      fe36dbf3efa775193b82ce03d1b329d3feced487

    • SHA256

      666c246bd662275c5a7330b4de2e51a7f86556390c0b79b1d774378e7eac8cb0

    • SHA512

      d8e52248278898617e42afe93171f4400612b37b596c8fef5d7f7d98a217a1f8ff86414a4f9e567d316980309a4e8d98050877dcef139f24cb77c85764d979a3

    • SSDEEP

      49152:IpMb87gil2wlWJDddoneZxq03EjlI+pOZjlx+o1Mj+6001YP:9bZRE4+Kr60n

    Score
    10/10
    xmrigevasionminerpersistencetrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • XMRig Miner payload

      miner

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks