Overview

overview

10

Static

static

3

73751b6b6c...04.exe

windows10-2004-x64

10

73751b6b6c...04.exe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    73751b6b6cef4a26579275fe51f68847418099594562f25205f36637c8b63304.exe
  • Size 584KB
  • Sample261005-th2jaaxbje
  • SHA256 73751b6b6cef4a26579275fe51f68847418099594562f25205f36637c8b63304
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
azaleaxmrigcollectiondefense_evasiondiscoveryminerpersistenceratspywaretrojan

Malware Config

Targets

    • Target
      73751b6b6cef4a26579275fe51f68847418099594562f25205f36637c8b63304.exe
    • Size 584KB
    • SHA256 73751b6b6cef4a26579275fe51f68847418099594562f25205f36637c8b63304
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondefense_evasiondiscoveryazaleaxmrigminerpersistenceratspywaretrojan

    • Detects Azalea RAT

    • Family: Azalea

      Azalea is a modular Windows RAT written in C#.

      ratazalea

    • Family: xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks