General
- Target Setup_latest.exe
- Size 16.8MB
- Sample261031-216jysaf63
- SHA256 43db1c8b806fcecdd4b752e8d093ff9c16c7ed7ee6333ff76807f2fe6c4c3ed4
Score
10/10
Malware Config
Targets
-
- Target Setup_latest.exe
- Size 16.8MB
- SHA256 43db1c8b806fcecdd4b752e8d093ff9c16c7ed7ee6333ff76807f2fe6c4c3ed4
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Downloads MZ/PE file
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Process Hollowing
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Process Hollowing
1