xmrig

General

Target

Zeta Spoofer.exe
Size

16.6MB
Sample

250127-zdqh4svkct
MD5

58c13144b662425b9373d0687fd6c291
SHA1

0664e627b6539d3ad79cb43d8e3131d5f3bb5b6a
SHA256

57b791d2c6eb50e566e19335af4f848a84fb0695d41afef156abccd753ba94a9
SHA512

c2534c081a34c2f825c59a926c95cdf00c1b23da2290581380c6ad1aa25523cba8e2346c0e54c2b56a7725eda862a2531828ed80edc93e37db9044c41039c960
SSDEEP

393216:5SDLxiW3R0mP1RmUh/ObTeJQlIvfcciFRM3P2lWVPNL+9m+O/:5oLRR0u1RmEOu0Ivfb3NNLz+

Score

10^/10

Malware Config

Targets

- Target
  
  Zeta Spoofer.exe
- Size
  
  16.6MB
- MD5
  
  58c13144b662425b9373d0687fd6c291
- SHA1
  
  0664e627b6539d3ad79cb43d8e3131d5f3bb5b6a
- SHA256
  
  57b791d2c6eb50e566e19335af4f848a84fb0695d41afef156abccd753ba94a9
- SHA512
  
  c2534c081a34c2f825c59a926c95cdf00c1b23da2290581380c6ad1aa25523cba8e2346c0e54c2b56a7725eda862a2531828ed80edc93e37db9044c41039c960
- SSDEEP
  
  393216:5SDLxiW3R0mP1RmUh/ObTeJQlIvfcciFRM3P2lWVPNL+9m+O/:5oLRR0u1RmEOu0Ivfb3NNLz+
Score

10^/10

xmrig defense_evasion discovery execution miner persistence pyinstaller upx
- Modifies security service
  defense_evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2