General

  • Target

    3b567592754e25eaa9246e3b267eebccaa870494c351b87ce2124f3e03a676aa

  • Size

    9.8MB

  • Sample

    241027-szrvqswqcn

  • MD5

    6f804d98df32ee28685d8468e619dd87

  • SHA1

    cc4813865c1600e7c7b772d692a37dd752a7cc6a

  • SHA256

    3b567592754e25eaa9246e3b267eebccaa870494c351b87ce2124f3e03a676aa

  • SHA512

    af1280f4db7b70f9a94f20837258a5a6ca7cbbe1a4cc44d0b938a10290496802793d631e4cce155597dfc05243624013750310a2baf260c085f29316682d37c4

  • SSDEEP

    196608:NfZ+pJEfu095vo5n8xnzv0jr+ao/hNJu+y19RERUAc9s:Nsx09xo5m70nm5NJuVRERUAY

Score
10/10

Malware Config

Targets

    • Target

      3b567592754e25eaa9246e3b267eebccaa870494c351b87ce2124f3e03a676aa

    • Size

      9.8MB

    • MD5

      6f804d98df32ee28685d8468e619dd87

    • SHA1

      cc4813865c1600e7c7b772d692a37dd752a7cc6a

    • SHA256

      3b567592754e25eaa9246e3b267eebccaa870494c351b87ce2124f3e03a676aa

    • SHA512

      af1280f4db7b70f9a94f20837258a5a6ca7cbbe1a4cc44d0b938a10290496802793d631e4cce155597dfc05243624013750310a2baf260c085f29316682d37c4

    • SSDEEP

      196608:NfZ+pJEfu095vo5n8xnzv0jr+ao/hNJu+y19RERUAc9s:Nsx09xo5m70nm5NJuVRERUAY

    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks