General
- Target KMSAuto++ x64.exe
- Size 23.5MB
- Sample260418-n18gnagy6r
- SHA256 bf82d3252d4d0e3373cf90e8e98dd8dbeb1fff467ebacacd009fdfc15d9290df
Malware Config
Targets
-
- Target KMSAuto++ x64.exe
- Size 23.5MB
- SHA256 bf82d3252d4d0e3373cf90e8e98dd8dbeb1fff467ebacacd009fdfc15d9290df
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates new service(s)
Executes dropped EXE
Loads dropped DLL
Stops running service(s)
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Defense Evasion
Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1