General
- Target file.exe
- Size 5.1MB
- Sample260803-khfgdaeg38
- SHA256 99394c069d6474ed22abfc96f3b73cd5f640539f85786cd3f842e4a03dd13494
Malware Config
Targets
-
- Target file.exe
- Size 5.1MB
- SHA256 99394c069d6474ed22abfc96f3b73cd5f640539f85786cd3f842e4a03dd13494
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Modifies security service
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Server Software Component: Terminal Services DLL
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Creates new service(s)
Cryptocurrency Miner
Makes network request to known mining pool URL.
Deletes itself
Disables service(s)
Executes dropped EXE
Stops running service(s)
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Power Settings
1Server Software Component
1Terminal Services DLL
1