xmrig | 8b192718f72331d27c2be75880c9b94450cec1916b527ea2c6249212315aa86b | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

14e809e5a2...KI.exe

windows7-x64

14e809e5a2...KI.exe

windows10-2004-x64

Sharing

General

Target

14e809e5a28ba863f634175f801438b0_NEIKI
Size

1.6MB
Sample

240507-yfxvjafa42
MD5

14e809e5a28ba863f634175f801438b0
SHA1

0cab11764bb8a01c0cc5556567186fc655a54c44
SHA256

8b192718f72331d27c2be75880c9b94450cec1916b527ea2c6249212315aa86b
SHA512

4df39abfbe37a24b5fce85e12db75a3e146551d357753988939902c0db59f215db644c5f74233720fbfb0789ca699b08be46f007df392f64bc37ec9a77b96881
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoCSxnhvuqAP9dbWmbOtK2Vk+RRVy:Lz071uv4BPMkHC0I6GCInhG1dtH08

Score

10^/10

xmrig execution miner upx

Static task

static1

upx miner xmrig

4 signatures

Behavioral task

behavioral1

Sample

14e809e5a28ba863f634175f801438b0_NEIKI.exe

Resource

win7-20240221-en

xmrig execution miner upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

14e809e5a28ba863f634175f801438b0_NEIKI.exe

Resource

win10v2004-20240419-en

xmrig execution miner upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  14e809e5a28ba863f634175f801438b0_NEIKI
- Size
  
  1.6MB
- MD5
  
  14e809e5a28ba863f634175f801438b0
- SHA1
  
  0cab11764bb8a01c0cc5556567186fc655a54c44
- SHA256
  
  8b192718f72331d27c2be75880c9b94450cec1916b527ea2c6249212315aa86b
- SHA512
  
  4df39abfbe37a24b5fce85e12db75a3e146551d357753988939902c0db59f215db644c5f74233720fbfb0789ca699b08be46f007df392f64bc37ec9a77b96881
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoCSxnhvuqAP9dbWmbOtK2Vk+RRVy:Lz071uv4BPMkHC0I6GCInhG1dtH08
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy