General
- Target file.exe
- Size 6.5MB
- Sample260925-tgctjavyay
- SHA256 97a76527d77d1d8e1f8a64ebdbccf60abc10220d1a8425ff48fd10a8f658b181
Malware Config
Targets
-
- Target file.exe
- Size 6.5MB
- SHA256 97a76527d77d1d8e1f8a64ebdbccf60abc10220d1a8425ff48fd10a8f658b181
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
UAC bypass
-
Windows security bypass
-
XMRig Miner payload
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4