Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cbe52dd629...KI.exe

windows7-x64

10

cbe52dd629...KI.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 02:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe

  • Size

    1.6MB

  • MD5

    cbe52dd62949c482c44ed2208d7c3b60

  • SHA1

    8191abb125b810baf871b8bed3771d960ecc5439

  • SHA256

    a28352a9ede830495cc6566b50cb80009749136abd4a4fb96d8a240dec29b1b4

  • SHA512

    67846ecbcec45bb60e7b06cfacc8bb30b5ddeedcfa228edd81fcd73964516dd5fb11c5c0b5b220f911ec39ccf95382b03927990be35f3e041444fc0df0122323

  • SSDEEP

    49152:yY+RCBteGuZyYNimrbuBB1XKM2Qbl0Fx8J4:ytCBt/EjNimfuBB5qx8J4

Score
10/10
xmrigminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 7 IoCs
    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
      C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cbe52dd62949c482c44ed2208d7c3b60_NEIKI.exe
    Filesize

    1.6MB

    MD5

    d3213a04fbd68db14905af82ba273827

    SHA1

    ca7d77ecbe97dbacf282345c71f0ab7d450a87bd

    SHA256

    968309d432322d8388647a3253d527bc5746c1a94436604b9e3c12e013a2de5d

    SHA512

    6ef97132fa5f3777c0589b9026d63183104bfc7609a7fac5fbae459b4ab352865c8c0e6c01a2d22fd37e4ad0e0451f45f5a1c52494552c16ecc104b87541ca65

    Download Submit

  • memory/2232-21-0x0000000021ED0000-0x000000002206E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2232-22-0x0000000000400000-0x0000000000582000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/2232-20-0x0000000000400000-0x0000000000A7A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/2232-28-0x0000000000400000-0x000000000057C000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/2232-27-0x00000000258B0000-0x0000000025A43000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2232-37-0x0000000025BD0000-0x0000000025D52000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/2232-38-0x0000000000400000-0x0000000000A7A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/2940-0-0x0000000000400000-0x0000000000A7A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/2940-13-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2940-4-0x0000000021D80000-0x0000000021F1E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2940-1-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

    Download