General
- Target forte.exe
- Size 13.8MB
- Sample261002-zzyfvavx5q
- SHA256 a99e1e71178ae8e923a9f0ca8eb831403f46ffb55dc03ac6a05d542b70a41ade
Malware Config
Targets
-
- Target forte.exe
- Size 13.8MB
- SHA256 a99e1e71178ae8e923a9f0ca8eb831403f46ffb55dc03ac6a05d542b70a41ade
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1System Services
2Service Execution
2Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Create or Modify System Process
2Windows Service
2Process Injection
1Process Hollowing
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1Process Injection
1Process Hollowing
1