General
- Target http://pesktop.com
- Sample261107-xcnl1set6x
Score
10/10
Malware Config
Targets
-
- Target http://pesktop.com
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Downloads MZ/PE file
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1