General
- Target 3.exe
- Size 8.5MB
- Sample260706-pdcl5sax5j
- SHA256 bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22
Score
10/10
Malware Config
Targets
-
- Target 3.exe
- Size 8.5MB
- SHA256 bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Suspicious use of NtCreateUserProcessOtherParentProcess
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Drops file in Drivers directory
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Creates new service(s)
Executes dropped EXE
Stops running service(s)
Themida packer
Detects Themida, an advanced Windows software protection system.
Checks whether UAC is enabled
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext