Overview

overview

10

Static

static

10

c9fc399396...70.exe

windows7-x64

10

c9fc399396...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70

  • Size

    1.3MB

  • Sample

    241118-223vfsxhlm

  • MD5

    a57016f893db9665846077362ea5930b

  • SHA1

    3f49d65d5dade2d23d00d6036fb7c466db461823

  • SHA256

    c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70

  • SHA512

    05d1f84641a576461cd55ec7da4af68bbbbcf180704bd90ff4659e758a99e8e756963833be324515e8e527ab3014bb8f2813a42f28fdad4589bd4d9e91f62135

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPIpxG:Lz071uv4BPMkibTIA5LDGTcw

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70

    • Size

      1.3MB

    • MD5

      a57016f893db9665846077362ea5930b

    • SHA1

      3f49d65d5dade2d23d00d6036fb7c466db461823

    • SHA256

      c9fc39939625fdd2ae3758cc4e8efbd2f37cd1bfc94662fb7cfc969e09a72c70

    • SHA512

      05d1f84641a576461cd55ec7da4af68bbbbcf180704bd90ff4659e758a99e8e756963833be324515e8e527ab3014bb8f2813a42f28fdad4589bd4d9e91f62135

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPIpxG:Lz071uv4BPMkibTIA5LDGTcw

    Score
    10/10
    xmrigexecutionminerupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks