xmrig | 069755dae534e8a0bb971d1fe63130508dc16ed4728575d8339105f5add6e61c

General

Target
682-spoofer.exe
Size 5.7MB
Sample261002-2fnhmsxtbs
SHA256 069755dae534e8a0bb971d1fe63130508dc16ed4728575d8339105f5add6e61c
MD5 eb262c88e2db73ca700fd6a86757c481
SHA1 428f2901083b8b9b46cce544cdc2f0399ddb7547
SHA512 221362ada4f0d2582c8c3610236136ef08252e82423ecb7599b571f4431bdcae5bc6c195f47ef1d8f9d16350b3622ddb03e2ff88a3f8d959ed020aa3dac3989c
SSDEEP 98304:3TK8wK7aaoLyzCqlyMkKf1uXknTquK//XeRmY0EFYRDB6RDHooU:31w/asElyzKf1uXkTFK//XQmY0EFYZR
TLSH
T17956BE3BDBC226E57058BBAE754B3D5AF3E950B4233D456BC06D3AD1AC09368C901C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  682-spoofer.exe
- Size 5.7MB
- SHA256 069755dae534e8a0bb971d1fe63130508dc16ed4728575d8339105f5add6e61c
- MD5 eb262c88e2db73ca700fd6a86757c481
- SHA1 428f2901083b8b9b46cce544cdc2f0399ddb7547
- SHA512 221362ada4f0d2582c8c3610236136ef08252e82423ecb7599b571f4431bdcae5bc6c195f47ef1d8f9d16350b3622ddb03e2ff88a3f8d959ed020aa3dac3989c
- SSDEEP 98304:3TK8wK7aaoLyzCqlyMkKf1uXknTquK//XeRmY0EFYRDB6RDHooU:31w/asElyzKf1uXkTFK//XQmY0EFYZR
- TLSH
  T17956BE3BDBC226E57058BBAE754B3D5AF3E950B4233D456BC06D3AD1AC09368C901C6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution xmrig miner persistence privilege_escalation ransomware spyware trojan upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
  defense_evasion privilege_escalation
- Modifies boot configuration data using bcdedit
  ransomware evasion
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2