General

  • Target

    f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe

  • Size

    2.9MB

  • Sample

    241027-f7f2zssndx

  • MD5

    5f10f34b3ef012f1db5f21755cad4ab1

  • SHA1

    439ab3bd92cd515b092607291ac054f3fad1359f

  • SHA256

    f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660

  • SHA512

    7f6473adb10d878b8c9cb9360c04ed843401d6eb69ca1df546e956e18032598cbdd1fffbdc45c0fe7d3927a6fa54ef77b9d2e10175e3ca15c6421cfa678d59ce

  • SSDEEP

    49152:ZtH86NYYGclfMk3iDPS6wcXLuankPBUJCBuB+zVma85E4xTz:ZtH8SHGc5MWiDdj7uakPBUJ1oV0EkTz

Malware Config

Targets

    • Target

      f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe

    • Size

      2.9MB

    • MD5

      5f10f34b3ef012f1db5f21755cad4ab1

    • SHA1

      439ab3bd92cd515b092607291ac054f3fad1359f

    • SHA256

      f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660

    • SHA512

      7f6473adb10d878b8c9cb9360c04ed843401d6eb69ca1df546e956e18032598cbdd1fffbdc45c0fe7d3927a6fa54ef77b9d2e10175e3ca15c6421cfa678d59ce

    • SSDEEP

      49152:ZtH86NYYGclfMk3iDPS6wcXLuankPBUJCBuB+zVma85E4xTz:ZtH8SHGc5MWiDdj7uakPBUJ1oV0EkTz

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks