xmrig | a28352a9ede830495cc6566b50cb80009749136abd4a4fb96d8a240dec29b1b4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
Size

1.6MB
MD5

cbe52dd62949c482c44ed2208d7c3b60
SHA1

8191abb125b810baf871b8bed3771d960ecc5439
SHA256

a28352a9ede830495cc6566b50cb80009749136abd4a4fb96d8a240dec29b1b4
SHA512

67846ecbcec45bb60e7b06cfacc8bb30b5ddeedcfa228edd81fcd73964516dd5fb11c5c0b5b220f911ec39ccf95382b03927990be35f3e041444fc0df0122323
SSDEEP

49152:yY+RCBteGuZyYNimrbuBB1XKM2Qbl0Fx8J4:ytCBt/EjNimfuBB5qx8J4

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/1728-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/1728-17-0x00000000237B0000-0x0000000023E2A000-memory.dmp	xmrig
behavioral1/memory/1728-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/memory/1036-31-0x00000000008E0000-0x0000000000A73000-memory.dmp	xmrig
behavioral1/memory/1036-34-0x0000000023770000-0x00000000238F2000-memory.dmp	xmrig
behavioral1/memory/1036-42-0x0000000000400000-0x000000000057C000-memory.dmp	xmrig
behavioral1/memory/1036-32-0x0000000000400000-0x000000000057C000-memory.dmp	xmrig
behavioral1/memory/1036-26-0x0000000000400000-0x0000000000582000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1036	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
1036	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

Loads dropped DLL 1 IoCs

pid	Process
1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
1036	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1036	1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe	30
PID 1728 wrote to memory of 1036	1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe	30
PID 1728 wrote to memory of 1036	1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe	30
PID 1728 wrote to memory of 1036	1728	cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe	30

C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
  C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

Filesize
1.6MB

MD5
dfab1bfa84991310fe832a2aa7efc983

SHA1
ecc4f7be4647b02cefbe89830cb13ffd787ebcb6

SHA256
801f4636bb5df2abe3cbad7c9dd22baf9b118a57669756157c032ba994950280

SHA512
f0611ca1d10a5d3007b5eb7d96e3e6504adc5e9cc99a741e4d917a7686d6d53170e8c28f365aaeb4a3e75a0170c23beda19d009b7e0075607be6e9c8f32b7a8e

Download Submit
memory/1036-31-0x00000000008E0000-0x0000000000A73000-memory.dmp

Filesize
1.6MB

Download
memory/1036-26-0x0000000000400000-0x0000000000582000-memory.dmp

Filesize
1.5MB

Download
memory/1036-32-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1036-42-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1036-18-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/1036-34-0x0000000023770000-0x00000000238F2000-memory.dmp

Filesize
1.5MB

Download
memory/1036-25-0x0000000021C20000-0x0000000021DBE000-memory.dmp

Filesize
1.6MB

Download
memory/1728-17-0x00000000237B0000-0x0000000023E2A000-memory.dmp

Filesize
6.5MB

Download
memory/1728-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1728-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1728-8-0x0000000021E90000-0x000000002202E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-0-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download