xmrig | e85141b23c76fe7b5b6cd7a7a6e4e3ccc444f8b7515e7883f64e1b91423997d8

General

Target
_e85141b23c76fe7b5b6cd7a7a6e4e3ccc444f8b7515e7883f64e1b91423997d8.exe
Size 3.3MB
Sample260625-qm4mnact3s
SHA256 e85141b23c76fe7b5b6cd7a7a6e4e3ccc444f8b7515e7883f64e1b91423997d8
MD5 6e9c7c732727236b82948c939557e019
SHA1 8cf247a166e94f8dd40c9aa87368c5de227eefce
SHA512 1ce45e4737ae8f601aed0a86cda06e53d54b807b3f510af584cbbdfc5c5e45cf96c61c0d0a29898aff83773cad4e5d7ceca4a2e954b558b557c3a0d22244134b
SSDEEP 49152:/X2sZ9J9gkqV34lxxHYWEBKgZSZVWuvN1Rc5ZQTpCuoc5T8NDfwQxtz:/X2Yr9gkqV3EYPUVWub4+NCo
TLSH
T12DF5339A958182BEEDDE0875C6BA7F7C7F2E72211F1246C641F4A47033736D79C2086A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _e85141b23c76fe7b5b6cd7a7a6e4e3ccc444f8b7515e7883f64e1b91423997d8.exe
- Size 3.3MB
- SHA256 e85141b23c76fe7b5b6cd7a7a6e4e3ccc444f8b7515e7883f64e1b91423997d8
- MD5 6e9c7c732727236b82948c939557e019
- SHA1 8cf247a166e94f8dd40c9aa87368c5de227eefce
- SHA512 1ce45e4737ae8f601aed0a86cda06e53d54b807b3f510af584cbbdfc5c5e45cf96c61c0d0a29898aff83773cad4e5d7ceca4a2e954b558b557c3a0d22244134b
- SSDEEP 49152:/X2sZ9J9gkqV34lxxHYWEBKgZSZVWuvN1Rc5ZQTpCuoc5T8NDfwQxtz:/X2Yr9gkqV3EYPUVWub4+NCo
- TLSH
  T12DF5339A958182BEEDDE0875C6BA7F7C7F2E72211F1246C641F4A47033736D79C2086A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2