Behavioral task
behavioral1
Sample
NEAS.40c7dd4b648799c080de3b093a632760.exe
Resource
win7-20231023-en
General
-
Target
NEAS.40c7dd4b648799c080de3b093a632760.exe
-
Size
1.7MB
-
MD5
40c7dd4b648799c080de3b093a632760
-
SHA1
8d8a9f3ee81788fed8d9e9226e10b3bc8644134d
-
SHA256
71aa8aa33b5809ac67494a0c4fdc79f8f03ed75df7f4b4e20676cfbe6cacaeca
-
SHA512
01903d3416de4f87398cec5b77c1487288d3b6bbe3525af7911c834a10c81b1d7b3e720a43e9ed072dfb6bd6eb1b4a08e4692d362448e6c43edff0d1a5587887
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIXSLOmL+2v0H9:BemTLkNdfE0pZrp
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.40c7dd4b648799c080de3b093a632760.exe
Files
-
NEAS.40c7dd4b648799c080de3b093a632760.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE