xmrig | b2e1e8209ddf392a28cd1aaa5148ddfe12dbf16ac2206d2f87928669905292da | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5e447ff029...AS.exe

windows7-x64

5e447ff029...AS.exe

windows10-2004-x64

Sharing

General

Target

5e447ff029a3fea4548e1239ac23c0a0_NEAS
Size

2.9MB
Sample

240507-d9vl2sbd87
MD5

5e447ff029a3fea4548e1239ac23c0a0
SHA1

78e290f5e4af7e315f0f2b723c9c141c2469db7d
SHA256

b2e1e8209ddf392a28cd1aaa5148ddfe12dbf16ac2206d2f87928669905292da
SHA512

abcdeb8753e9927816a2d648e977d5e68717cab1eb63e97b22492bece74143fd76d2da77d6d59c4b9d6f9e40373cd43fdf95f55299b82c613e4a7fce9edb1d06
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IBcAUNRSaY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb

Score

10^/10

xmrig execution miner upx

Static task

static1

miner upx xmrig

4 signatures

Behavioral task

behavioral1

Sample

5e447ff029a3fea4548e1239ac23c0a0_NEAS.exe

Resource

win7-20240221-en

xmrig execution miner upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

5e447ff029a3fea4548e1239ac23c0a0_NEAS.exe

Resource

win10v2004-20240419-en

xmrig execution miner upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  5e447ff029a3fea4548e1239ac23c0a0_NEAS
- Size
  
  2.9MB
- MD5
  
  5e447ff029a3fea4548e1239ac23c0a0
- SHA1
  
  78e290f5e4af7e315f0f2b723c9c141c2469db7d
- SHA256
  
  b2e1e8209ddf392a28cd1aaa5148ddfe12dbf16ac2206d2f87928669905292da
- SHA512
  
  abcdeb8753e9927816a2d648e977d5e68717cab1eb63e97b22492bece74143fd76d2da77d6d59c4b9d6f9e40373cd43fdf95f55299b82c613e4a7fce9edb1d06
- SSDEEP
  
  49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IBcAUNRSaY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy