General
- Target OurNew.exe
- Size 5.6MB
- Sample261113-pegmgsbw4k
- SHA256 d62ae1ad8e28df1e3d1455d1df95f75d677b5eacb5c5e40968e0e1f4a24220ae
Malware Config
Targets
-
- Target OurNew.exe
- Size 5.6MB
- SHA256 d62ae1ad8e28df1e3d1455d1df95f75d677b5eacb5c5e40968e0e1f4a24220ae
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates new service(s)
Executes dropped EXE
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Stops running service(s)
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1System Services
2Service Execution
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3