xmrig | bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22

General

Target
SecuriteInfo.com.Trojan.BankBot.3375.31629.24773.exe
Size 8.5MB
Sample260706-kkpg3agx9r
SHA256 bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22
MD5 71c8888a76a1307c4d3d9449e9908a18
SHA1 4082dd0939a02f4ed9cad405e93088e2ec91359e
SHA512 03f21c27f09c838f6ffa4e977e0adf4548357dddc415d12572d67542d634432e0f9d32862a9f7c66fd0b6c1c2f095499c57d355db767fa0838311f5bde7c8f76
SSDEEP 196608:WyN4PBZdXnWQVvZWSipqJWkLDNAbK2xtc1oq21CA5t2wwxeNHD5kAAZVjRCY:VedWmE5kLDCbJW/21FtzwMNHVk/HVC
TLSH
T1809633A4705E0C2CCA2893F0F29B755644F8377A7F6B0E83E1150E545E1A3CE9BA786D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SecuriteInfo.com.Trojan.BankBot.3375.31629.24773.exe
- Size 8.5MB
- SHA256 bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22
- MD5 71c8888a76a1307c4d3d9449e9908a18
- SHA1 4082dd0939a02f4ed9cad405e93088e2ec91359e
- SHA512 03f21c27f09c838f6ffa4e977e0adf4548357dddc415d12572d67542d634432e0f9d32862a9f7c66fd0b6c1c2f095499c57d355db767fa0838311f5bde7c8f76
- SSDEEP 196608:WyN4PBZdXnWQVvZWSipqJWkLDNAbK2xtc1oq21CA5t2wwxeNHD5kAAZVjRCY:VedWmE5kLDCbJW/21FtzwMNHVk/HVC
- TLSH
  T1809633A4705E0C2CCA2893F0F29B755644F8377A7F6B0E83E1150E545E1A3CE9BA786D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence themida trojan adware xmrig miner ransomware spyware
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2