Overview

overview

10

Static

static

3

1/Melonity.exe

windows7-x64

7

1/Melonity.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1.rar

  • Size

    40.1MB

  • Sample

    241120-qr76mssjej

  • MD5

    580c7a610e32c0836909aa65ea3e2a2b

  • SHA1

    718f53871800fd669838de704581c57a733f86e9

  • SHA256

    5505113cc5cfb404e46177773536fc22afa357661ee2af0f56720de38b0e4fec

  • SHA512

    2ee6128e242a4807c3e793266438a40b6c9c4b45be70836cc4847da433e7af83e9f5e6967752729254cd0f74045a8f0645411a5a7977cdcd14e42dc289ef521c

  • SSDEEP

    786432:X/1/P0KRCOw/beNnvEqcdZxzOaWA1nAWD9NnLweoQK69v6UekS9Tk7/bj/lqDU:Xt082/iNsqcv/ZnA8NnENQK69s/TO/39

Score
10/10
xmrigdiscoveryevasionexecutionminerpersistenceupx

Malware Config

Targets

    • Target

      1/Melonity.exe

    • Size

      5.3MB

    • MD5

      2b8ed38b6c08850779d90156b49787d8

    • SHA1

      aea6b1e78ba9d53b2c02be0d865d230f00548035

    • SHA256

      45bcb27494dee65e5a36650054ff8b3041ebdb99fd78d4f8e3d8a41eb073c148

    • SHA512

      1bc2863bd2ba39b123fd458e3bb4151405f98d221361f49503444169096333ab1b6818000cccf282c0f90083d5029225e1b1b53c32f99416d1b2622e2151c917

    • SSDEEP

      98304:CSYl+O1E/Uo8EoT9AfvDm+CIUzwNhiDbY1UaV/:CS7Uo/bfyhIUziUbIU+

    Score
    10/10
    discoveryxmrigevasionexecutionminerpersistenceupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks