General
- Target SilentumSpoofer.zip
- Size 4.9MB
- Sample260804-tnkgysde27
- SHA256 7e29a8f40b60923488ce5e2a3b59cb504aa4602c38a9c278b3b6f68db6095818
Malware Config
Targets
-
- Target SilentumSpoofer/Box.bat
- Size 5KB
- SHA256 64556d24498bcd280cd7cc248a98ed22c4db921495d825f141af1547c8fdd275
Score3/10 -
- Target SilentumSpoofer/Button.bat
- Size 5KB
- SHA256 38aa0c1ad69d96732c776cbd73275f5ccb881d42158158b32815dad869ef9876
Score3/10 -
- Target SilentumSpoofer/Commands/Hidden/Adapters.exe
- Size 335KB
- SHA256 b3de6d10d9f94037b88f736609e50a8a4c4d516ca50107dedd575797a654c28e
Score1/10 -
- Target SilentumSpoofer/Commands/Hidden/Adapters2.exe
- Size 341KB
- SHA256 4c831252aa6f193c4474ba74f352bee7d00099dfaf5ac6e98ab1253e21999b4a
Score1/10 -
- Target SilentumSpoofer/Commands/Hidden/AlternateStreamView.exe
- Size 109KB
- SHA256 669ce40107a2e05fc93dd37df55c77eb155705b449b2e236423e8bb96b9985f0
Score3/10 -
- Target SilentumSpoofer/Commands/Hidden/Block.exe
- Size 119KB
- SHA256 dfd08e1d7a34bae6836b3915b45b8637b85cdc998198c5bf148fba5e96f15c21
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target SilentumSpoofer/Commands/Hidden/UnbanComplete.vbs
- Size 49B
- SHA256 537f70f7b018610dfedd4bcecf041d845eab0c673e129185c2345eb68a95fe77
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target SilentumSpoofer/Commands/Hidden/process.bat
- Size 1001B
- SHA256 ef702ce2f8fb1bc71fb60e8b95cb83cef4fa66aa96afd7ca4fd67c96530b6e53
Score5/10-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target SilentumSpoofer/Commands/Hidden/spoofer.sys
- Size 6KB
- SHA256 1992c044963f5c77aa7b5462e2bb69a37c66bc0e13032524fb1663c0314fd420
Score3/10 -
- Target SilentumSpoofer/GetInput.exe
- Size 3KB
- SHA256 3f5c64717a0092ae214154a730e96e2e56921be2e3f1121a3e98b1ba84627665
Score3/10 -
- Target SilentumSpoofer/Getlen.bat
- Size 1KB
- SHA256 83ce5342710a2f2e385a363402661e3426728dd6bcfe9d87e22f2fb858b07bde
Score3/10 -
- Target SilentumSpoofer/Silentum_Spoofer.exe
- Size 8.0MB
- SHA256 6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target SilentumSpoofer/batbox.exe
- Size 1KB
- SHA256 9553bc17fa0fd08e026c1865812b3388e3d5495a5394bbf671e5a8f21c79989a
Score3/10 -
- Target SilentumSpoofer/colorecho-vc10-x86_64.exe
- Size 129KB
- SHA256 76fe5f9cef2c3a5c4f765d4c45167f4cf26cc6d469031f0d195d96724e9d82a8
Score1/10 -
- Target SilentumSpoofer/hwid.ps1
- Size 3KB
- SHA256 c7c54526b07f457e58d423ab22d61a0efd78ad112be2ef0a1efe6c25013df185
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1