General
- Target https://cdn.discordapp.com/attachments/1356054713396760677/1545939232013680732/larp-v7.jar?ex=6a9df79b&is=6a9ca61b&hm=bc00af14dc996200516287d62c7b928fd7b711cacf18e0e8247bdc75d9154f79&
- Sample260906-arqzcssvhz
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1356054713396760677/1545939232013680732/larp-v7.jar?ex=6a9df79b&is=6a9ca61b&hm=bc00af14dc996200516287d62c7b928fd7b711cacf18e0e8247bdc75d9154f79&
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1