General
- Target PrestigeInjector.exe
- Size 430KB
- Sample260708-mxgdbsfv4q
- SHA256 c2985aa844e95a7db5a2311d367b2d7270b0d79fa0121b5e479b1fbca411be2b
Score
10/10
Malware Config
Targets
-
- Target PrestigeInjector.exe
- Size 430KB
- SHA256 c2985aa844e95a7db5a2311d367b2d7270b0d79fa0121b5e479b1fbca411be2b
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext