Overview

overview

10

Static

static

3

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs... K.exe

windows7-x64

10

grhddhsGHs... K.exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

grhddhsGHs...1).exe

windows7-x64

10

grhddhsGHs...1).exe

windows10-2004-x64

10

grhddhsGHs...2).exe

windows7-x64

10

grhddhsGHs...2).exe

windows10-2004-x64

10

grhddhsGHs...3).exe

windows7-x64

10

grhddhsGHs...3).exe

windows10-2004-x64

10

grhddhsGHs...4).exe

windows7-x64

10

grhddhsGHs...4).exe

windows10-2004-x64

10

grhddhsGHs...5).exe

windows7-x64

10

grhddhsGHs...5).exe

windows10-2004-x64

10

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

Resubmissions

11/02/2025, 16:33

250211-t2ztsstkey10

11/02/2025, 16:33

250211-t2zh2atkex10

11/02/2025, 16:33

250211-t2yxhatkew10

11/02/2025, 16:33

250211-t2nrjasqdk10

24/10/2024, 20:12

241024-yyvg5asemn10

24/10/2024, 20:11

241024-yygk9ssemk10

24/10/2024, 20:11

241024-yygahasemj10

24/10/2024, 20:11

241024-yyd55sselq10

24/10/2024, 20:08

241024-yw247asdqp10

24/10/2024, 20:08

241024-yw1lcssdqn10

Sharing

Copy URL Twitter E-mail

General

  • Target
    grhddhsGHswgh.zip
  • Size 53.2MB
  • Sample241024-yygk9ssemk
  • SHA256 ae23dce6045773f7debde8d12221f2e8a0c356a2b048d2863fb35fb0840fde3e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (16).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (17) - K.exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (17).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5behavioral6
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (18).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7behavioral8
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (19).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10behavioral9
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (20).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral11behavioral12
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (21).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (22).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (23).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (24).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19behavioral20
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (25).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral21behavioral22
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (26).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral23behavioral24
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (27).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral25behavioral26
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (28).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral27behavioral28
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (29).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral29behavioral30
    • Target
      grhddhsGHswgh/qM5GMXBk6hJE6Y5e (30).exe
    • Size 2.0MB
    • SHA256 cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

xmrigexecutionminerupx
Score
10/10

behavioral2

xmrigexecutionminerupx
Score
10/10

behavioral3

xmrigexecutionminerupx
Score
10/10

behavioral4

xmrigexecutionminerupx
Score
10/10

behavioral5

xmrigexecutionminerupx
Score
10/10

behavioral6

xmrigexecutionminerupx
Score
10/10

behavioral7

xmrigexecutionminerupx
Score
10/10

behavioral8

xmrigexecutionminerupx
Score
10/10

behavioral9

xmrigexecutionminerupx
Score
10/10

behavioral10

xmrigexecutionminerupx
Score
10/10

behavioral11

xmrigexecutionminerupx
Score
10/10

behavioral12

xmrigexecutionminerupx
Score
10/10

behavioral13

xmrigexecutionminerupx
Score
10/10

behavioral14

xmrigexecutionminerupx
Score
10/10

behavioral15

xmrigexecutionminerupx
Score
10/10

behavioral16

xmrigexecutionminerupx
Score
10/10

behavioral17

xmrigexecutionminerupx
Score
10/10

behavioral18

xmrigexecutionminerupx
Score
10/10

behavioral19

xmrigexecutionminerupx
Score
10/10

behavioral20

xmrigexecutionminerupx
Score
10/10

behavioral21

xmrigexecutionminerupx
Score
10/10

behavioral22

xmrigexecutionminerupx
Score
10/10

behavioral23

xmrigexecutionminerupx
Score
10/10

behavioral24

xmrigexecutionminerupx
Score
10/10

behavioral25

xmrigexecutionminerupx
Score
10/10

behavioral26

xmrigexecutionminerupx
Score
10/10

behavioral27

xmrigexecutionminerupx
Score
10/10

behavioral28

xmrigexecutionminerupx
Score
10/10

behavioral29

xmrigexecutionminerupx
Score
10/10

behavioral30

xmrigexecutionminerupx
Score
10/10

behavioral31

xmrigexecutionminerupx
Score
10/10

behavioral32

xmrigexecutionminerupx
Score
10/10