xmrig | 79088f709ace121ddd46454556418b10772ecc5e92e4cf1c05d2447061497de4

General

Target
c8a02af40d7b4d4b8f6f01b7c54ac74b
Size 38KB
Sample260825-pnpdpaak2w
SHA256 79088f709ace121ddd46454556418b10772ecc5e92e4cf1c05d2447061497de4
MD5 baae0824a447593092968670c46ad98d
SHA1 fa5364f79812f673061df5fbe1c08f7a1408ca65
SHA512 e14740b746647289c1b834990fe2068528e545539a980c22ff3b395a0f4cf33f5d091ec89bb2a86841a7e0e805aac775e75877df311249c23a4b78ac22d7b367
SSDEEP 384:zP4/2/m9OXmujjqx9rqzQOAq9blwiAi+i/Mw5LTVsnrhEUTS81N93FRRMGEy:Akm9jSQTq/NdP3TVwpOGb
TLSH
T19503E86758F260212113C0E5AE75B74EBA61800BC757C985B4EC4698EFCFEE68C176CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  c8a02af40d7b4d4b8f6f01b7c54ac74b
- Size 38KB
- SHA256 79088f709ace121ddd46454556418b10772ecc5e92e4cf1c05d2447061497de4
- MD5 baae0824a447593092968670c46ad98d
- SHA1 fa5364f79812f673061df5fbe1c08f7a1408ca65
- SHA512 e14740b746647289c1b834990fe2068528e545539a980c22ff3b395a0f4cf33f5d091ec89bb2a86841a7e0e805aac775e75877df311249c23a4b78ac22d7b367
- SSDEEP 384:zP4/2/m9OXmujjqx9rqzQOAq9blwiAi+i/Mw5LTVsnrhEUTS81N93FRRMGEy:Akm9jSQTq/NdP3TVwpOGb
- TLSH
  T19503E86758F260212113C0E5AE75B74EBA61800BC757C985B4EC4698EFCFEE68C176CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware discovery execution xmrig miner persistence ransomware spyware stealer
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1