Behavioral task
behavioral1
Sample
3ed0474b9e1a0250965c4d1e273cef20_NEAS.exe
Resource
win7-20240221-en
General
-
Target
3ed0474b9e1a0250965c4d1e273cef20_NEAS
-
Size
2.9MB
-
MD5
3ed0474b9e1a0250965c4d1e273cef20
-
SHA1
2441b54a918dbde776cfb2220a74a1a6090d3522
-
SHA256
6b679ae2a3da5334f3b17ce4dc60cf3a0ed6d65b0b2395f2dd62b6cbcaebf89c
-
SHA512
f13bb8b7abdf720a1b644d79d5325ff36d5038cf5b71f85c4ab2cd0191ed4a149fc8123c9dc81279d72ffb57295f9f274f41706b008b7a243cb677805bd413aa
-
SSDEEP
49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzHUh+hNskqCP:N0GnJMOWPClFdx6e0EALKWVTffZiPAcr
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ed0474b9e1a0250965c4d1e273cef20_NEAS
Files
-
3ed0474b9e1a0250965c4d1e273cef20_NEAS.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE