General
- Target Retrac.Setup.2.1.2.exe
- Size 679.0MB
- Sample260602-jfmx1ags3x
- SHA256 624c81cef7dccb8f78cda162750cb9f2029bf9ff8a4bd5d60c027d0264beb6c8
Malware Config
Targets
-
- Target Retrac.Setup.2.1.2.exe
- Size 679.0MB
- SHA256 624c81cef7dccb8f78cda162750cb9f2029bf9ff8a4bd5d60c027d0264beb6c8
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Possible privilege escalation attempt
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Checks whether UAC is enabled
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Network Share Discovery
Attempt to gather information on host network.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Discovery
Network Share Discovery
1Peripheral Device Discovery
2Query Registry
4Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1