Overview

overview

10

Static

static

3

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs... K.exe

windows7-x64

10

grhddhsGHs... K.exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

grhddhsGHs...1).exe

windows7-x64

10

grhddhsGHs...1).exe

windows10-2004-x64

10

grhddhsGHs...2).exe

windows7-x64

10

grhddhsGHs...2).exe

windows10-2004-x64

10

grhddhsGHs...3).exe

windows7-x64

10

grhddhsGHs...3).exe

windows10-2004-x64

10

grhddhsGHs...4).exe

windows7-x64

10

grhddhsGHs...4).exe

windows10-2004-x64

10

grhddhsGHs...5).exe

windows7-x64

10

grhddhsGHs...5).exe

windows10-2004-x64

10

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

Resubmissions

24-10-2024 20:12

241024-yyvg5asemn 10

24-10-2024 20:11

241024-yygk9ssemk 10

24-10-2024 20:11

241024-yygahasemj 10

24-10-2024 20:11

241024-yyd55sselq 10

24-10-2024 20:08

241024-yw247asdqp 10

24-10-2024 20:08

241024-yw1lcssdqn 10

24-10-2024 20:08

241024-ywx58ssdql 10

22-08-2024 20:59

240822-zs4paaxemb 10

22-08-2024 20:59

240822-zs2jxszern 10

22-08-2024 20:59

240822-zsy4ssxelg 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    grhddhsGHswgh.zip

  • Size

    53.2MB

  • Sample

    240822-zs2jxszern

  • MD5

    e7829a2c6a5e0e7a0f07976f652df0d3

  • SHA1

    4ace192783189ce4ff8e6297c2c96b571ca5438d

  • SHA256

    ae23dce6045773f7debde8d12221f2e8a0c356a2b048d2863fb35fb0840fde3e

  • SHA512

    e7be579f99e25e3dba8c1bde247869d1f182343ec8178b221d4faee61b6f1e763e0f93ffcc80daddca9b2fd6a27c21a7fdd1fc01107554e05fbc087d3bb6d5e2

  • SSDEEP

    1572864:G35orrXsJzR9dDnvD1AsR48wYrlZ+k3JAW7pSLpuwU:GpJJzzdLKsRs+lkk3mWqpuwU

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (16).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (17) - K.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (17).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (18).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral7behavioral8

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (19).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral10behavioral9

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (20).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral11behavioral12

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (21).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral13behavioral14

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (22).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral15behavioral16

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (23).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral17behavioral18

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (24).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral19behavioral20

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (25).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral21behavioral22

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (26).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral23behavioral24

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (27).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral25behavioral26

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (28).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral27behavioral28

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (29).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral29behavioral30

    • Target

      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (30).exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

xmrigexecutionminerupx
Score
10/10

behavioral2

xmrigexecutionminerupx
Score
10/10

behavioral3

xmrigexecutionminerupx
Score
10/10

behavioral4

xmrigexecutionminerupx
Score
10/10

behavioral5

xmrigexecutionminerupx
Score
10/10

behavioral6

xmrigexecutionminerupx
Score
10/10

behavioral7

xmrigexecutionminerupx
Score
10/10

behavioral8

xmrigexecutionminerupx
Score
10/10

behavioral9

xmrigexecutionminerupx
Score
10/10

behavioral10

xmrigexecutionminerupx
Score
10/10

behavioral11

xmrigexecutionminerupx
Score
10/10

behavioral12

xmrigexecutionminerupx
Score
10/10

behavioral13

xmrigexecutionminerupx
Score
10/10

behavioral14

xmrigexecutionminerupx
Score
10/10

behavioral15

xmrigexecutionminerupx
Score
10/10

behavioral16

xmrigexecutionminerupx
Score
10/10

behavioral17

xmrigexecutionminerupx
Score
10/10

behavioral18

xmrigexecutionminerupx
Score
10/10

behavioral19

xmrigexecutionminerupx
Score
10/10

behavioral20

xmrigexecutionminerupx
Score
10/10

behavioral21

xmrigexecutionminerupx
Score
10/10

behavioral22

xmrigexecutionminerupx
Score
10/10

behavioral23

xmrigexecutionminerupx
Score
10/10

behavioral24

xmrigexecutionminerupx
Score
10/10

behavioral25

xmrigexecutionminerupx
Score
10/10

behavioral26

xmrigexecutionminerupx
Score
10/10

behavioral27

xmrigexecutionminerupx
Score
10/10

behavioral28

xmrigexecutionminerupx
Score
10/10

behavioral29

xmrigexecutionminerupx
Score
10/10

behavioral30

xmrigexecutionminerupx
Score
10/10

behavioral31

xmrigexecutionminerupx
Score
10/10

behavioral32

xmrigexecutionminerupx
Score
10/10