xmrig | 9aff1b6cabf030af5eea993fe6f2417b2c0e969d824698f5ef89327571872a46

General

Target
Temp.BAT
Size 12KB
Sample260812-cp7kfatvbx
SHA256 9aff1b6cabf030af5eea993fe6f2417b2c0e969d824698f5ef89327571872a46
MD5 5937548240738fe0a54bd14484d2b5c1
SHA1 4fc21159f66f25ef12e9934078a0eda51588d0a1
SHA512 0fdc1d12bc6e47f226fd6dfc688f79456e65ba9ed4a0b0b503f7b86901e202510ad071a4344ddcd0143019c11d3bd175797ad595cdc7d3fa33190a869f1fb1aa
SSDEEP 384:Ni1OcYTnPySr64PcA0EBffQ5dyT/TA8pcrmNNZ6w5w/4M2R0pJtdU7WxbL37r/B7:fzlM2mJt2EL3qCl3
TLSH
T16542872734499C1A8162A6E1DAFB5A11BB75D3478E513FC1B4EAE0847807354C3AEECF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Temp.BAT
- Size 12KB
- SHA256 9aff1b6cabf030af5eea993fe6f2417b2c0e969d824698f5ef89327571872a46
- MD5 5937548240738fe0a54bd14484d2b5c1
- SHA1 4fc21159f66f25ef12e9934078a0eda51588d0a1
- SHA512 0fdc1d12bc6e47f226fd6dfc688f79456e65ba9ed4a0b0b503f7b86901e202510ad071a4344ddcd0143019c11d3bd175797ad595cdc7d3fa33190a869f1fb1aa
- SSDEEP 384:Ni1OcYTnPySr64PcA0EBffQ5dyT/TA8pcrmNNZ6w5w/4M2R0pJtdU7WxbL37r/B7:fzlM2mJt2EL3qCl3
- TLSH
  T16542872734499C1A8162A6E1DAFB5A11BB75D3478E513FC1B4EAE0847807354C3AEECF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery dropper evasion execution xmrig impact miner persistence ransomware trojan
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- XMRig Miner payload
  miner
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Download via BitsAdmin
  dropper
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2