xmrig | 1fea46727e2a69874b6a4b52a1c4686438767716f32397bba1dfb117b1f60662 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

de4d30d5a4...KI.exe

windows7-x64

de4d30d5a4...KI.exe

windows10-2004-x64

Sharing

General

Target

de4d30d5a41ffd6311b60f0b884f0c60_NEIKI
Size

1.6MB
Sample

240508-r1195abg44
MD5

de4d30d5a41ffd6311b60f0b884f0c60
SHA1

8c79d88a82a31dc6120296b61ad7217af93cb659
SHA256

1fea46727e2a69874b6a4b52a1c4686438767716f32397bba1dfb117b1f60662
SHA512

2e977dcd0240b376cb3c599fe523b120b5c62bdc2312434d02cbbf0af0a9b94bc79804a94f7ddf230793b72e23e6ca0ce07778cf8229ee80af9c46f9d53e249a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXiBLm:Lz071uv4BPMkHC0IaSEzQR4iRlm

Score

10^/10

xmrig execution miner upx

Static task

static1

upx miner xmrig

4 signatures

Behavioral task

behavioral1

Sample

de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe

Resource

win7-20240221-en

xmrig execution miner upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe

Resource

win10v2004-20240508-en

xmrig execution miner upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  de4d30d5a41ffd6311b60f0b884f0c60_NEIKI
- Size
  
  1.6MB
- MD5
  
  de4d30d5a41ffd6311b60f0b884f0c60
- SHA1
  
  8c79d88a82a31dc6120296b61ad7217af93cb659
- SHA256
  
  1fea46727e2a69874b6a4b52a1c4686438767716f32397bba1dfb117b1f60662
- SHA512
  
  2e977dcd0240b376cb3c599fe523b120b5c62bdc2312434d02cbbf0af0a9b94bc79804a94f7ddf230793b72e23e6ca0ce07778cf8229ee80af9c46f9d53e249a
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXiBLm:Lz071uv4BPMkHC0IaSEzQR4iRlm
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy