Behavioral task
behavioral1
Sample
NEAS.c7e53d3a09f19ad2aac35447ba5fbb20.exe
Resource
win7-20230831-en
General
-
Target
NEAS.c7e53d3a09f19ad2aac35447ba5fbb20.exe
-
Size
2.6MB
-
MD5
c7e53d3a09f19ad2aac35447ba5fbb20
-
SHA1
eb3a2e957267a158269871496bd40684274de953
-
SHA256
6f4d4f855d1668b4603f217dfd01e63965ce4dbf176442294bad343ee10f39dc
-
SHA512
3f8043271508c364979dea26cb9612ae9fec56f3e6c0925c162aaa5820dd02e7b7830f0e7ff64ac322633a39421799943283052da7b53ae67a1d531afb0ecaba
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoTzDh:BemTLkNdfE0pZrV56utgpPFod
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c7e53d3a09f19ad2aac35447ba5fbb20.exe
Files
-
NEAS.c7e53d3a09f19ad2aac35447ba5fbb20.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE