General
- Target fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309.exe
- Size 5.0MB
- Sample260820-1mptlsbj8w
- SHA256 fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309
Score
10/10
Malware Config
Targets
-
- Target fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309.exe
- Size 5.0MB
- SHA256 fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Modifies security service
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Server Software Component: Terminal Services DLL
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Creates new service(s)
Cryptocurrency Miner
Makes network request to known mining pool URL.
Deletes itself
Disables service(s)
Executes dropped EXE
Stops running service(s)
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Power Settings
1Server Software Component
1Terminal Services DLL
1