General
- Target https://cdn.discordapp.com/attachments/1519446808542314527/1540238902781018245/dY2Lwc82cLbY.exe?ex=6a893ac2&is=6a87e942&hm=13cfa8b4c9309dc9aa861bef332ad1ceb9ce0d2e73d1d527cf246b4469450628&
- Sample260821-gv8rxathrd
Score
10/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1519446808542314527/1540238902781018245/dY2Lwc82cLbY.exe?ex=6a893ac2&is=6a87e942&hm=13cfa8b4c9309dc9aa861bef332ad1ceb9ce0d2e73d1d527cf246b4469450628&
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of SetThreadContext