General
- Target KingsExploit.exe
- Size 1.1MB
- Sample261012-3thd8azs6m
- SHA256 9eee549c0cca10e0f1e33d9f1e655f9e64b42241b6ba431ad4b6b2197cace808
Malware Config
Targets
-
- Target KingsExploit.exe
- Size 1.1MB
- SHA256 9eee549c0cca10e0f1e33d9f1e655f9e64b42241b6ba431ad4b6b2197cace808
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Modifies Windows Firewall
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Masquerading
1Match Legitimate Name or Location
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1