xmrig | 6773d5157b433a22db33a6ab83f35c32413111a512443e8048e9140042c235c1 | Triage

Sharing

General

Target

AnyDesk.exe
Size

1.3MB
Sample

250201-ka1gksvndv
MD5

5ff8ee7475afdd2db20e9258e7dcb50c
SHA1

95c4299c50f07edeb61f4487b9b3cbc60d132e1e
SHA256

6773d5157b433a22db33a6ab83f35c32413111a512443e8048e9140042c235c1
SHA512

955be61044269cbcc382525600ae636b0eff573d5e9ba21aaadb8cc4d8462e0d2e860134f82792c60b9e11634bee2864321171e60732a5a9bca5d864d56653e2
SSDEEP

24576:TT4A/dlGFy6v4YakPz8dCSUNoER/Td8DG/ytY6v/87xaVUhf4pE0swIem:TMA1lGFF3zQCSUNHRbd8DGqtY6WhfD06

Score

10^/10

xmrig defense_evasion execution miner persistence

Malware Config

Targets

- Target
  
  AnyDesk.exe
- Size
  
  1.3MB
- MD5
  
  5ff8ee7475afdd2db20e9258e7dcb50c
- SHA1
  
  95c4299c50f07edeb61f4487b9b3cbc60d132e1e
- SHA256
  
  6773d5157b433a22db33a6ab83f35c32413111a512443e8048e9140042c235c1
- SHA512
  
  955be61044269cbcc382525600ae636b0eff573d5e9ba21aaadb8cc4d8462e0d2e860134f82792c60b9e11634bee2864321171e60732a5a9bca5d864d56653e2
- SSDEEP
  
  24576:TT4A/dlGFy6v4YakPz8dCSUNoER/Td8DG/ytY6v/87xaVUhf4pE0swIem:TMA1lGFF3zQCSUNHRbd8DGqtY6WhfD06
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionexecutionpersistence