xmrig | 9f3d247576ec82fd9b05f65662d1f272e7c9eab8e2892b89425d6690c940fe07 | Triage

Sharing

General

Target

adivina.exe
Size

1.3MB
Sample

250201-gxjwkasnex
MD5

9d4c3c56d23c1d085d65a8f18e3360c0
SHA1

8a6380f6b1b599c3988cf1246afec9cd815cbf51
SHA256

9f3d247576ec82fd9b05f65662d1f272e7c9eab8e2892b89425d6690c940fe07
SHA512

d11a4213f06fbf702caf376cb1921bd5390b49e38bde1ff94bceeb52bd93e98cb33a2da2b90541b6c4eb3669f68e472b4bbe3d37e6dad229850ebe40bc2558c5
SSDEEP

24576:l5T4A/dXgFI65Ux5PYgMBLVYyLJDI8kz5/40tY6v/87xaVUhffpE03wIzm:l5MA1XgF06gGLVYuJDI8kz5ztY6WhfW/

Score

10^/10

xmrig defense_evasion execution miner persistence

Malware Config

Targets

- Target
  
  adivina.exe
- Size
  
  1.3MB
- MD5
  
  9d4c3c56d23c1d085d65a8f18e3360c0
- SHA1
  
  8a6380f6b1b599c3988cf1246afec9cd815cbf51
- SHA256
  
  9f3d247576ec82fd9b05f65662d1f272e7c9eab8e2892b89425d6690c940fe07
- SHA512
  
  d11a4213f06fbf702caf376cb1921bd5390b49e38bde1ff94bceeb52bd93e98cb33a2da2b90541b6c4eb3669f68e472b4bbe3d37e6dad229850ebe40bc2558c5
- SSDEEP
  
  24576:l5T4A/dXgFI65Ux5PYgMBLVYyLJDI8kz5/40tY6v/87xaVUhffpE03wIzm:l5MA1XgF06gGLVYuJDI8kz5ztY6WhfW/
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionexecutionpersistence