Behavioral task
behavioral1
Sample
835427752ba994650083a3881b02fb00_NEAS.exe
Resource
win7-20240419-en
General
-
Target
835427752ba994650083a3881b02fb00_NEAS
-
Size
3.0MB
-
MD5
835427752ba994650083a3881b02fb00
-
SHA1
9e7d029b04a6d224dfe1cb965dd9ddd4e32099ee
-
SHA256
3ae1c062ee654197fb917a95111c6d9b1557d49c194782599ca0fb0cbe1bfbcc
-
SHA512
20e2c7cc3e19d8714021b53b0d43770b3a2466ee785f73476040300636637704e76a027c5f6c1d89c7de4d78b2e0291436a3e734192b113f38c63e36d802cbde
-
SSDEEP
98304:N0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc40L:NFWPClFkL
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 835427752ba994650083a3881b02fb00_NEAS
Files
-
835427752ba994650083a3881b02fb00_NEAS.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE