xmrig | 1312c83001740b9beffa16609894a56e34ba97e314071fd6195a3ab2de3829d0

General

Target
winlogon (1).exe
Size 1.1MB
Sample260907-kmp7dasgla
SHA256 1312c83001740b9beffa16609894a56e34ba97e314071fd6195a3ab2de3829d0
MD5 6aab8650308aaedfd550c13ce70bd302
SHA1 d5a37029c0e4c0665004e7ffa113ec2dc9045ab4
SHA512 61e0de7ab984903d770c8d988ee518124690f2b66957f76f081df9e1401d610427e3c2650fbd1505f108f06d2cd8d81b98d9ba453d57306174ebbcf63fc74a15
SSDEEP 12288:Ybs/m0E54jwaFXGc8lEBBBHGBKq2IZwDfwvfqItNqdg:YbOVE5ifGPRZwUvf3fd
TLSH
T129357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  winlogon (1).exe
- Size 1.1MB
- SHA256 1312c83001740b9beffa16609894a56e34ba97e314071fd6195a3ab2de3829d0
- MD5 6aab8650308aaedfd550c13ce70bd302
- SHA1 d5a37029c0e4c0665004e7ffa113ec2dc9045ab4
- SHA512 61e0de7ab984903d770c8d988ee518124690f2b66957f76f081df9e1401d610427e3c2650fbd1505f108f06d2cd8d81b98d9ba453d57306174ebbcf63fc74a15
- SSDEEP 12288:Ybs/m0E54jwaFXGc8lEBBBHGBKq2IZwDfwvfqItNqdg:YbOVE5ifGPRZwUvf3fd
- TLSH
  T129357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer defense_evasion execution xmrig miner persistence privilege_escalation
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2