xmrig | 4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d | Triage

Submit
Reports

Overview

overview

Static

static

1

JaffaCakes...9d.exe

windows7-x64

7

JaffaCakes...9d.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d
Size

6.6MB
Sample

241222-ghvphswpel
MD5

e4ce16957129f0ce094c9eaae8672333
SHA1

aed6f0d4abb26ee4df7814a14fa59fcb0fb2f013
SHA256

4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d
SHA512

c6c51a3345c191ef694b595406665e9b31ba935de10dcd6be7c6bcf46c158a4a5e58b5e21ebd59a15207dec2feb7a45ddfbb8d6ba21f56c57423bd895c63228d
SSDEEP

196608:NERwPy8YGUdxPSgB/aSoJxJgczOLX5UNm2m31BNL/Ys2tIs+:KRwK8YGMq+V0D7zOL/1BNLgfIP

Score

10^/10

xmrig discovery miner persistence upx

Static task

static1

Behavioral task

behavioral1

Sample

JaffaCakes118_4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d.exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d.exe

Resource

win10v2004-20241007-en

xmrig discovery miner persistence upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d
- Size
  
  6.6MB
- MD5
  
  e4ce16957129f0ce094c9eaae8672333
- SHA1
  
  aed6f0d4abb26ee4df7814a14fa59fcb0fb2f013
- SHA256
  
  4c0e74a2eb39808b4abd6107e7dcc17a27d9b80d014aac1fedf58e8fda231c9d
- SHA512
  
  c6c51a3345c191ef694b595406665e9b31ba935de10dcd6be7c6bcf46c158a4a5e58b5e21ebd59a15207dec2feb7a45ddfbb8d6ba21f56c57423bd895c63228d
- SSDEEP
  
  196608:NERwPy8YGUdxPSgB/aSoJxJgczOLX5UNm2m31BNL/Ys2tIs+:KRwK8YGMq+V0D7zOL/1BNLgfIP
Score

10^/10

discovery persistence xmrig miner upx
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

xmrigdiscoveryminerpersistenceupx

© 2018-2024

Terms | Privacy