Extracted

• • Target
    file_c8e4af3ea647650f.exe
  • Size 950KB
  • SHA256 b80016aa911026ba0e71f2818f600b7499eddf87ebfc317c6c9cc7ed53a91c27
  • MD5 6b636a30bca03c84f89c83712e2e1475
  • SHA1 3274a2d2d5722ffa9071ff07bfcc044946dbfba1
  • SHA512 015106c29d299990eba4938ff2c52f87012c5fe94f83b364934fa5751c31140557f71c9e34f12d587d55b471b7d65e24da97a3a6832c85ada1e7457e9f1ed09c
  • SSDEEP 12288:lKcEqRFgm3MnNgZgG3WTLoAWmYYopYjaKO32SXFqzwlIKu:lKcXKnh3YwGKO32SXYMU
  • TLSH
    T1D9255C1FE39980EAD46AD17982865321FE70BC524760B9CF16A047213F56EF4AF3EB14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxmrigminerpersistence

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Modify Registry: Disable Windows Driver Blocklist

    Disable Windows Driver Blocklist via Registry.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2