Overview

overview

10

Static

static

3

7fb0c52a7b...4e.exe

windows7-x64

10

7fb0c52a7b...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7fb0c52a7b5e96e7ea04dd110ed6a4a66e596df0c510124495b9371eaff2664e

  • Size

    7.7MB

  • Sample

    241118-1dtffavhnc

  • MD5

    dff8ecfa64a8a66beef7172630154886

  • SHA1

    a6e5292cd687ef1e24e6b33dfb94100ee653581f

  • SHA256

    7fb0c52a7b5e96e7ea04dd110ed6a4a66e596df0c510124495b9371eaff2664e

  • SHA512

    16aebda3b069057f2d09a6b97dafcfdc3592c51e156b9b97fa1f6ce1c473012d4d30ddad56f288cc8d90874533a5f96a237570e22e0e976f8fd14028ceedc338

  • SSDEEP

    196608:yf0QEZE0l9zhyvHsMTULD4pWblpJDttO6K1jPl29Ax7MvE4nlL:rt/l91G+D4pQttDmM9AVMc

Score
10/10
xmrigevasionexecutionminerpersistenceupx

Malware Config

Targets

    • Target

      7fb0c52a7b5e96e7ea04dd110ed6a4a66e596df0c510124495b9371eaff2664e

    • Size

      7.7MB

    • MD5

      dff8ecfa64a8a66beef7172630154886

    • SHA1

      a6e5292cd687ef1e24e6b33dfb94100ee653581f

    • SHA256

      7fb0c52a7b5e96e7ea04dd110ed6a4a66e596df0c510124495b9371eaff2664e

    • SHA512

      16aebda3b069057f2d09a6b97dafcfdc3592c51e156b9b97fa1f6ce1c473012d4d30ddad56f288cc8d90874533a5f96a237570e22e0e976f8fd14028ceedc338

    • SSDEEP

      196608:yf0QEZE0l9zhyvHsMTULD4pWblpJDttO6K1jPl29Ax7MvE4nlL:rt/l91G+D4pQttDmM9AVMc

    Score
    10/10
    xmrigevasionexecutionminerpersistenceupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Stops running service(s)

      evasionexecution

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks