Overview

overview

10

Static

static

3

RIMIX X!TRE.exe

windows7-x64

10

RIMIX X!TRE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RIMIX X!TRE.rar

  • Size

    2.6MB

  • Sample

    241224-vbza1ssnap

  • MD5

    fd958f314b715e2aba5e181789516467

  • SHA1

    8c329504987d695a40813b89ba93391225b53135

  • SHA256

    2aba29deec0bd0dc4d028360b9abdd30dc3b81b0e20bb40e3be7e5cb3240f76c

  • SHA512

    207d5e91c232614c2980c22920fd746ded1c01cfee8ca24a00310418266addc9e6de2c8137ee416b9779ba89580e75038559cdc7d5d2906bae1b0e189fa388c6

  • SSDEEP

    49152:x8Rknfy2QmkasYluLNGAegv0fjZvXjHEmGlawcbkR4it+uxKKwvYa:aGnK2QaI4Jgc6Vc8Kl1

Score
10/10
xmrigevasionexecutionminerpersistenceupx

Malware Config

Targets

    • Target

      RIMIX X!TRE.exe

    • Size

      3.9MB

    • MD5

      4b341683eae9ea9941df5fd7e60c7a09

    • SHA1

      9318f92e924f54fdd856dac5839220af15cd8601

    • SHA256

      0bffdd22b6c00bbe5da4a1cf4e84089cf8c50c7aa93993b652b2dedcd5d75237

    • SHA512

      65805b2daade2b204c7b3316ea69c91feb6133c7bba70ccf36eba7abb83d087565e9bb450292afc83416dc04b66ee8ce26304cc46e37f480a081913e760683ef

    • SSDEEP

      98304:fJs+xKkTwxRk+LkcddlstjcX9LqHpy96KZB:hxNwxiArlwjcX9L/6+

    Score
    10/10
    xmrigevasionexecutionminerpersistenceupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks