xmrig | 6b7f6d33611b0362d7a60dea3e6f75f3745b3ebb9d25285106bc945943b14af5

General

Target
_6b7f6d33611b0362d7a60dea3e6f75f3745b3ebb9d25285106bc945943b14af5.exe
Size 3.3MB
Sample260625-qp8dmacv7p
SHA256 6b7f6d33611b0362d7a60dea3e6f75f3745b3ebb9d25285106bc945943b14af5
MD5 c59d0913b35a03b8beb220ec4d261298
SHA1 9e568ddf9ffbcfbab62f61e592c27d18e0cbc5ba
SHA512 f1589330b99682ad5889c3ef17ec30bed9a4432ff6a27395f2ae8773cc6d72f5dbb1291b52755e3a787412f22c76e81c9a0970fa12ba0a4be95e7e6603e9df8c
SSDEEP 49152:pzEHKu/txkrLUCojxcCX8SoiUC6hfWYlQa6gr27RGbkc6guxFAa6hdEkGjbCTns2:pzEH/tdTknQsYgIpkS
TLSH
T12EF533D1D0426FBCC1D7DB3883BC6F28A77A72B90F1449D70699FA502A36EC35920D99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _6b7f6d33611b0362d7a60dea3e6f75f3745b3ebb9d25285106bc945943b14af5.exe
- Size 3.3MB
- SHA256 6b7f6d33611b0362d7a60dea3e6f75f3745b3ebb9d25285106bc945943b14af5
- MD5 c59d0913b35a03b8beb220ec4d261298
- SHA1 9e568ddf9ffbcfbab62f61e592c27d18e0cbc5ba
- SHA512 f1589330b99682ad5889c3ef17ec30bed9a4432ff6a27395f2ae8773cc6d72f5dbb1291b52755e3a787412f22c76e81c9a0970fa12ba0a4be95e7e6603e9df8c
- SSDEEP 49152:pzEHKu/txkrLUCojxcCX8SoiUC6hfWYlQa6gr27RGbkc6guxFAa6hdEkGjbCTns2:pzEH/tdTknQsYgIpkS
- TLSH
  T12EF533D1D0426FBCC1D7DB3883BC6F28A77A72B90F1449D70699FA502A36EC35920D99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2