Overview

overview

10

Static

static

3

2024-10-04...im.exe

windows7-x64

7

2024-10-04...im.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-10-04_32bc051ff64f31196eb4128c8076abc5_magniber_nymaim

  • Size

    5.4MB

  • Sample

    241004-pm3vpatfjk

  • MD5

    32bc051ff64f31196eb4128c8076abc5

  • SHA1

    19d036a655ff8f75df86f127b82ae102292ae05c

  • SHA256

    b5967f9817bfe7f839d6199e17ff7d67d85bac94c148382277fd41ad930a298a

  • SHA512

    4ef36abceaaff7a2758092141efbd9ea3e6d02817a40f86b01da7cd2d8a9f0bb706964737875e7db5a812db272358a99376bbb5d4faee96c544a148ff30ca120

  • SSDEEP

    98304:sMDtIXLr06AdfEThF35Pzu4QVKB4DRrMolMynO/64FcnHq3zNMwTn+f3qJ0:UrmEdF3ED1IynO1FcnHezN9Tn4b

Score
10/10
xmrigdefense_evasiondiscoveryexecutionminerpyinstaller

Malware Config

Targets

    • Target

      2024-10-04_32bc051ff64f31196eb4128c8076abc5_magniber_nymaim

    • Size

      5.4MB

    • MD5

      32bc051ff64f31196eb4128c8076abc5

    • SHA1

      19d036a655ff8f75df86f127b82ae102292ae05c

    • SHA256

      b5967f9817bfe7f839d6199e17ff7d67d85bac94c148382277fd41ad930a298a

    • SHA512

      4ef36abceaaff7a2758092141efbd9ea3e6d02817a40f86b01da7cd2d8a9f0bb706964737875e7db5a812db272358a99376bbb5d4faee96c544a148ff30ca120

    • SSDEEP

      98304:sMDtIXLr06AdfEThF35Pzu4QVKB4DRrMolMynO/64FcnHq3zNMwTn+f3qJ0:UrmEdF3ED1IynO1FcnHezN9Tn4b

    Score
    10/10
    discoveryxmrigdefense_evasionexecutionminerpyinstaller

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks