xmrig | 13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

13dd3aad70...f4.exe

windows7-x64

13dd3aad70...f4.exe

windows10-2004-x64

Sharing

General

Target

13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4
Size

5.6MB
Sample

241120-y5ncdsscjb
MD5

575b0f1c3318264e931e13915c059b72
SHA1

1406a899244cbc4116bd13bfcd442cda0d2d8247
SHA256

13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4
SHA512

69060b1772333190c05f6e9ded871b282f8e6458ab910bc9b74cf5b8d99715b2aba2cc03261d3aada2eb5333effc930b10999bc429253225953c8de3bded8ae1
SSDEEP

98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj

Score

10^/10

xmrig evasion execution miner persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4.exe

Resource

win7-20240903-en

xmrig evasion execution miner persistence upx

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4.exe

Resource

win10v2004-20241007-en

xmrig evasion execution miner persistence upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4
- Size
  
  5.6MB
- MD5
  
  575b0f1c3318264e931e13915c059b72
- SHA1
  
  1406a899244cbc4116bd13bfcd442cda0d2d8247
- SHA256
  
  13dd3aad7021921ca1f247310053d6da1f7eb3e0888828554f1be47110905df4
- SHA512
  
  69060b1772333190c05f6e9ded871b282f8e6458ab910bc9b74cf5b8d99715b2aba2cc03261d3aada2eb5333effc930b10999bc429253225953c8de3bded8ae1
- SSDEEP
  
  98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Score

10^/10

xmrig evasion execution miner persistence upx
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Stops running service(s)
  evasion execution
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Power Settings

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

xmrigevasionexecutionminerpersistenceupx

behavioral2

xmrigevasionexecutionminerpersistenceupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.