xmrig | df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685

General

Target
df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
Size 9.6MB
Sample260527-e16hmahv6y
SHA256 df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685
MD5 cf5ee1a12b467b8a5d44354c3e6051d5
SHA1 c0ec96a8984726eeb6ed89b8179d63c93c309ba0
SHA512 46831ed2f26ece406575888bbf54dc3da0a4175f47995528570bf15594feed9637dbbf90506774794b29b517c4f3f6e4ad13304f2bf1bd4ac1b7d6a554bc7fd7
SSDEEP 49152:i+HWcQ42IY8TChpiMC7bjYu1GCrDyIpGRlWAcW/5XGvRKa7sOsu0/Z8ak6F6yGo1:Kj
TLSH
T192A6CF407BE2BEF17291C11EB356C8344A5F3CB8F0DEEAE6904597A72482141AFED974
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685.exe
- Size 9.6MB
- SHA256 df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685
- MD5 cf5ee1a12b467b8a5d44354c3e6051d5
- SHA1 c0ec96a8984726eeb6ed89b8179d63c93c309ba0
- SHA512 46831ed2f26ece406575888bbf54dc3da0a4175f47995528570bf15594feed9637dbbf90506774794b29b517c4f3f6e4ad13304f2bf1bd4ac1b7d6a554bc7fd7
- SSDEEP 49152:i+HWcQ42IY8TChpiMC7bjYu1GCrDyIpGRlWAcW/5XGvRKa7sOsu0/Z8ak6F6yGo1:Kj
- TLSH
  T192A6CF407BE2BEF17291C11EB356C8344A5F3CB8F0DEEAE6904597A72482141AFED974
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation upx evasion ransomware
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Modifies boot configuration data using bcdedit
- Modifies boot configuration data using bcdedit
  ransomware evasion
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2