General
- Target Launcher.exe
- Size 1.1MB
- Sample260715-3mls3af17r
- SHA256 9c914019e875ef76693634ec8f05fbdc7dc7f7ac6f00022c437e593ffed34a0f
Malware Config
Targets
-
- Target Launcher.exe
- Size 1.1MB
- SHA256 9c914019e875ef76693634ec8f05fbdc7dc7f7ac6f00022c437e593ffed34a0f
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Modifies Windows Firewall
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
6Credentials In Files
6