xmrig | d1518d0bd89529e64e3e4e8a433b988c99334b2c3ebdbdf85de312addaa8bbbf

General

Target
_d1518d0bd89529e64e3e4e8a433b988c99334b2c3ebdbdf85de312addaa8bbbf.exe
Size 3.3MB
Sample260625-p7kjvab16w
SHA256 d1518d0bd89529e64e3e4e8a433b988c99334b2c3ebdbdf85de312addaa8bbbf
MD5 142f7ff0f06bc597c7eb5904a4bdeeb8
SHA1 5c49266edcc4865fb0491de8a8b9ff09f751a13e
SHA512 107e556f16faaa00b09edf3f58bfb62b9c771f84c35ee4c2385828e8d22548e50f3d25b6d28cdba3db30d28a7e55a2de6f1c69d05a09a990706012891edf7942
SSDEEP 49152:dY6ycEm+9UzmyqJpXURqQ4KjeBp6MYbbgTZ/gP00SjJNtSK3K+zB/FIqC:dY9m+6z57XLm6MYbkhB0SVKQIq
TLSH
T14BF533521183DCBDD9A2893D99E28E358577B010672214DF32E7686C8D29FF1BF38E49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _d1518d0bd89529e64e3e4e8a433b988c99334b2c3ebdbdf85de312addaa8bbbf.exe
- Size 3.3MB
- SHA256 d1518d0bd89529e64e3e4e8a433b988c99334b2c3ebdbdf85de312addaa8bbbf
- MD5 142f7ff0f06bc597c7eb5904a4bdeeb8
- SHA1 5c49266edcc4865fb0491de8a8b9ff09f751a13e
- SHA512 107e556f16faaa00b09edf3f58bfb62b9c771f84c35ee4c2385828e8d22548e50f3d25b6d28cdba3db30d28a7e55a2de6f1c69d05a09a990706012891edf7942
- SSDEEP 49152:dY6ycEm+9UzmyqJpXURqQ4KjeBp6MYbbgTZ/gP00SjJNtSK3K+zB/FIqC:dY9m+6z57XLm6MYbkhB0SVKQIq
- TLSH
  T14BF533521183DCBDD9A2893D99E28E358577B010672214DF32E7686C8D29FF1BF38E49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2