Overview

overview

10

Static

static

3

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    29.8MB

  • Sample

    241221-vw421avjdl

  • MD5

    f39a0615ad5482c3ffd8f46baeac3ac3

  • SHA1

    e4cd77ab330f734e7a5253c07c559e8c92d88c35

  • SHA256

    643494eec31570d49b4b101281ae8d5c58ebcb7311ccece8d1c478fefbadde9b

  • SHA512

    fecb43e388dd09421083554def45d750ae848cacd061c078a7a5e02820edd3ca761240fd0a6ec2672223afe07b887d6d789f7ae9c65f40b9437196427f001481

  • SSDEEP

    786432:PkvEnDem3vOYqVx9BvEiI8hXcclLOhiKw+HSD:svEn6mfN4xvcehFs7SD

Score
10/10
xmrigexecutionminer

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      29.8MB

    • MD5

      f39a0615ad5482c3ffd8f46baeac3ac3

    • SHA1

      e4cd77ab330f734e7a5253c07c559e8c92d88c35

    • SHA256

      643494eec31570d49b4b101281ae8d5c58ebcb7311ccece8d1c478fefbadde9b

    • SHA512

      fecb43e388dd09421083554def45d750ae848cacd061c078a7a5e02820edd3ca761240fd0a6ec2672223afe07b887d6d789f7ae9c65f40b9437196427f001481

    • SSDEEP

      786432:PkvEnDem3vOYqVx9BvEiI8hXcclLOhiKw+HSD:svEn6mfN4xvcehFs7SD

    Score
    10/10
    xmrigexecutionminer

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks