xmrig | dd9eb55d35232b79b8fd3105f96c320d9b68e75cecb148d8b628b2c26c9bda44

General

Target
_dd9eb55d35232b79b8fd3105f96c320d9b68e75cecb148d8b628b2c26c9bda44.exe
Size 3.3MB
Sample260625-qa4rwsct5q
SHA256 dd9eb55d35232b79b8fd3105f96c320d9b68e75cecb148d8b628b2c26c9bda44
MD5 9f286fc8152bfc5e2f3d51b10f5775b3
SHA1 578ed6e6ba3c1b0a6e1601d1da3b0159f7498d63
SHA512 d8598b2b987c8813a9a80ef065c576f9ab1f39813fd38ce0b861caec5e2176d9e929e1d1a7caed9cf282f6ea4b1c2f03daab7da5cfaeba27223ac06f7a78d444
SSDEEP 49152:7NloTf71SUSky256SxXvNCG08kkhVbwp+sRNQpSv9rFAU7LLdkPEDqE/:7NlA1SoICvNoc9wpzR9FqI
TLSH
T16AF5338A7A7059BCE3AB6E7503CCAF128415B5050B6179E366F24B063726DC273B7D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _dd9eb55d35232b79b8fd3105f96c320d9b68e75cecb148d8b628b2c26c9bda44.exe
- Size 3.3MB
- SHA256 dd9eb55d35232b79b8fd3105f96c320d9b68e75cecb148d8b628b2c26c9bda44
- MD5 9f286fc8152bfc5e2f3d51b10f5775b3
- SHA1 578ed6e6ba3c1b0a6e1601d1da3b0159f7498d63
- SHA512 d8598b2b987c8813a9a80ef065c576f9ab1f39813fd38ce0b861caec5e2176d9e929e1d1a7caed9cf282f6ea4b1c2f03daab7da5cfaeba27223ac06f7a78d444
- SSDEEP 49152:7NloTf71SUSky256SxXvNCG08kkhVbwp+sRNQpSv9rFAU7LLdkPEDqE/:7NlA1SoICvNoc9wpzR9FqI
- TLSH
  T16AF5338A7A7059BCE3AB6E7503CCAF128415B5050B6179E366F24B063726DC273B7D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2