General
- Target 0ecf3547251601ff8fe19f49b499afcc2ad311c529475cfa69b9946a9411fb57
- Size 2.6MB
- Sample260814-kqxevsyfpf
- SHA256 0ecf3547251601ff8fe19f49b499afcc2ad311c529475cfa69b9946a9411fb57
Malware Config
Targets
-
- Target 0ecf3547251601ff8fe19f49b499afcc2ad311c529475cfa69b9946a9411fb57
- Size 2.6MB
- SHA256 0ecf3547251601ff8fe19f49b499afcc2ad311c529475cfa69b9946a9411fb57
Score10/10-
Detect Neshta payload
-
Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Change Default File Association
1Power Settings
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Change Default File Association
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1