Overview

overview

10

Static

static

10

377a7cb3e9...7a.exe

windows7-x64

10

377a7cb3e9...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    377a7cb3e946d8b38c785198b92822a3d48d5d955bf3b8df7352b4db0ff2a17a.exe

  • Size

    1.9MB

  • Sample

    240705-esjznavcnf

  • MD5

    46c26b919894d06904d07694b0f1a560

  • SHA1

    8e712ad44de8ba8112de3a70e5233627470f428f

  • SHA256

    377a7cb3e946d8b38c785198b92822a3d48d5d955bf3b8df7352b4db0ff2a17a

  • SHA512

    f61ac7365173754ce46edd19d07fa87e92facf3c6f25937e53c4124b660ca40f7cf604f21bb25c58d2b8adbd0427379c250fe71bf3b14e6ed56a8ff87c9d0620

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6DBvSArT4yXEqU32EaSGN:Lz071uv4BPMkFfdk2af+vP4y0qUnGN

Score
10/10
xmrigexecutionminerpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      377a7cb3e946d8b38c785198b92822a3d48d5d955bf3b8df7352b4db0ff2a17a.exe

    • Size

      1.9MB

    • MD5

      46c26b919894d06904d07694b0f1a560

    • SHA1

      8e712ad44de8ba8112de3a70e5233627470f428f

    • SHA256

      377a7cb3e946d8b38c785198b92822a3d48d5d955bf3b8df7352b4db0ff2a17a

    • SHA512

      f61ac7365173754ce46edd19d07fa87e92facf3c6f25937e53c4124b660ca40f7cf604f21bb25c58d2b8adbd0427379c250fe71bf3b14e6ed56a8ff87c9d0620

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6DBvSArT4yXEqU32EaSGN:Lz071uv4BPMkFfdk2af+vP4y0qUnGN

    Score
    10/10
    xmrigexecutionminerpersistenceprivilege_escalationupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Privilege Escalation

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks