Overview

overview

10

Static

static

3

FreeSpoofe...er.exe

windows7-x64

10

FreeSpoofe...er.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FreeSpoofer.zip

  • Size

    21.6MB

  • Sample

    241118-wdjh1s1gnh

  • MD5

    5ffb4cdfa6f01b1752bafc0173bbd8bf

  • SHA1

    3f9d94d094c24addb4c784d943b7aaf5dd1512a3

  • SHA256

    92362fe11f69225f240fab45a39ea7b1b385e35c9921812c871bb349f94b28a3

  • SHA512

    8674128549b842ba8a030fde9b63049307b2cf405fdd3728ebc3ab024cbb4a5b04d1346c15d794fe8281fd047f8dc493fbaeee0c86aec5af705e0b552eb75ddb

  • SSDEEP

    393216:FwSbBkqSZKxZUwZWupZNNQ6Hi14ODNNEPc9OcQbhatuz85iq/pn8cC:FLBkNoWufA6C14EXEOVQbD8Wd

Score
10/10
xmrigdiscoveryevasionexecutionminerpersistence

Malware Config

Targets

    • Target

      FreeSpoofer/Loader.exe

    • Size

      26.4MB

    • MD5

      aec49804a232eb45a7cf41e2dfef37fc

    • SHA1

      5cedbd522c3c40305f6d656f57edf9b6a89d7e21

    • SHA256

      deb7985a8f9a56f2dcbfdd4c5fa4732daad89ce82733818915f3a4e07c2d3b09

    • SHA512

      ad9cf94db9a109e0f3a191169025c4f5ec86aca68937c373380dcb84c728b5817bf5e7bee8eea47b7cb82f5415234ab08a53f26030a5573d574477571f3a3d3d

    • SSDEEP

      786432:pfjx8ZSLqcnnTNPefii+ydGI5mM3y9nEDQ:pfadJy9nQQ

    Score
    10/10
    xmrigdiscoveryevasionexecutionminerpersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Looks for VMWare Tools registry key

      evasion

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

6
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks