xmrig | 451ad91c9f074f8ff02db9f6a1d2eab157ac3bf492ee0248022dbb7b441cc773 | Triage

Sharing

General

Target

AnyDesk.exe
Size

1.3MB
Sample

250201-jb3snatpc1
MD5

782d830545931b36f876fba9d8d8259e
SHA1

28255138010a047aa7d4414f666ea8123b89a5e6
SHA256

451ad91c9f074f8ff02db9f6a1d2eab157ac3bf492ee0248022dbb7b441cc773
SHA512

32a76cba28186842d2392d2faca54426e69baf49f7345b819c26719401f5955d5ae4ea64ac745e331b137c3bf13570642fb48bc8c511fa927525a957b033c7c8
SSDEEP

24576:yT4A/dnOFN6gyTWoCAzPRDsaMgHT8E9J/ItY6v/87xaVUhf4pE0XwaTU:yMA1nOF8iAjRDsafHT8E9JgtY6WhfD0u

Score

10^/10

xmrig defense_evasion execution miner persistence

Malware Config

Targets

- Target
  
  AnyDesk.exe
- Size
  
  1.3MB
- MD5
  
  782d830545931b36f876fba9d8d8259e
- SHA1
  
  28255138010a047aa7d4414f666ea8123b89a5e6
- SHA256
  
  451ad91c9f074f8ff02db9f6a1d2eab157ac3bf492ee0248022dbb7b441cc773
- SHA512
  
  32a76cba28186842d2392d2faca54426e69baf49f7345b819c26719401f5955d5ae4ea64ac745e331b137c3bf13570642fb48bc8c511fa927525a957b033c7c8
- SSDEEP
  
  24576:yT4A/dnOFN6gyTWoCAzPRDsaMgHT8E9J/ItY6v/87xaVUhf4pE0XwaTU:yMA1nOF8iAjRDsafHT8E9JgtY6WhfD0u
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionexecutionpersistence