General
- Target la7ITHEwjwKtqnlo.exe
- Size 33.3MB
- Sample261113-pczqaabs5v
- SHA256 d48d8c87335633e9ccf35f6b2fcae5146cc357194ec3d9b4e74b94549b759a25
Malware Config
Targets
-
- Target la7ITHEwjwKtqnlo.exe
- Size 33.3MB
- SHA256 d48d8c87335633e9ccf35f6b2fcae5146cc357194ec3d9b4e74b94549b759a25
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Modifies security service
Suspicious use of NtCreateUserProcessOtherParentProcess
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Creates new service(s)
Cryptocurrency Miner
Makes network request to known mining pool URL.
Deletes itself
Disables service(s)
Modifies file permissions
Stops running service(s)
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
3Service Execution
3Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Create or Modify System Process
4Windows Service
4Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
1