xmrig | 00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc

General

Target
_00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe
Size 3.3MB
Sample260625-p7ct1ab151
SHA256 00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc
MD5 8dca820fa28aa408d9686b79a038631d
SHA1 5b764b2e0ef983ce885b22a6019468141548e6ed
SHA512 9415204f82d9ccd3645ec7a17bc59c5d883e5279a7ea96d174507d688d494f3093b0229986345a13e91fe0dceca14f59b7a8ed9127e1b304ca07e8f3d6eb98cc
SSDEEP 49152:OUwkzEhdvPicJn8V/VZifVwPDiglJCPqOV0c1LicsKplzH8qI3vbGxD7i1xrVcD:OU9zELacJ89f427igSPB/zc1GFG9Vk
TLSH
T119F533C4459D27BCD69E8AB4E76E6FC2976F908D43016E8F73E084B02BD36D19B35608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc.exe
- Size 3.3MB
- SHA256 00c765d93bbf7f11013dcfb30a0143b0d2620e39f4e8ef47c0dcde10663276bc
- MD5 8dca820fa28aa408d9686b79a038631d
- SHA1 5b764b2e0ef983ce885b22a6019468141548e6ed
- SHA512 9415204f82d9ccd3645ec7a17bc59c5d883e5279a7ea96d174507d688d494f3093b0229986345a13e91fe0dceca14f59b7a8ed9127e1b304ca07e8f3d6eb98cc
- SSDEEP 49152:OUwkzEhdvPicJn8V/VZifVwPDiglJCPqOV0c1LicsKplzH8qI3vbGxD7i1xrVcD:OU9zELacJ89f427igSPB/zc1GFG9Vk
- TLSH
  T119F533C4459D27BCD69E8AB4E76E6FC2976F908D43016E8F73E084B02BD36D19B35608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2