General
- Target x86__setup_now.exe
- Size 13.9MB
- Sample261107-xd6h8a1sgv
- SHA256 824cc9174a72b44a1bc8ec780492276dbd7e6be187e3231ab32c06be76b0348b
Score
10/10
Malware Config
Targets
-
- Target x86__setup_now.exe
- Size 13.9MB
- SHA256 824cc9174a72b44a1bc8ec780492276dbd7e6be187e3231ab32c06be76b0348b
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Downloads MZ/PE file
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Obfuscated Files or Information
1Command Obfuscation
1