xmrig | 9ad8f3c941a1f74cf5ea0c6dcc4a873ebdee6ed54cc0474b2cb6fdd8cdb8d539 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

803c23f783...cs.exe

windows7-x64

803c23f783...cs.exe

windows10-2004-x64

Sharing

General

Target

803c23f783825cf10a2b445b46088aa0_NeikiAnalytics
Size

2.6MB
Sample

240516-cyc27agf46
MD5

803c23f783825cf10a2b445b46088aa0
SHA1

e25ffe77532c100c63a9e633ab27fd94724144ad
SHA256

9ad8f3c941a1f74cf5ea0c6dcc4a873ebdee6ed54cc0474b2cb6fdd8cdb8d539
SHA512

7988ea9e4b31e587e79c33dec8d06b9aeed2609bbe1c85cf40e414a961683df7f72840526a6d996536a6f5bb9c3e706b1cd161a61028c0b39d30f4ab61576b21
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2H:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF

Score

10^/10

xmrig execution miner upx

Static task

static1

miner upx xmrig

4 signatures

Behavioral task

behavioral1

Sample

803c23f783825cf10a2b445b46088aa0_NeikiAnalytics.exe

Resource

win7-20240508-en

xmrig execution miner upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

803c23f783825cf10a2b445b46088aa0_NeikiAnalytics.exe

Resource

win10v2004-20240508-en

xmrig execution miner upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  803c23f783825cf10a2b445b46088aa0_NeikiAnalytics
- Size
  
  2.6MB
- MD5
  
  803c23f783825cf10a2b445b46088aa0
- SHA1
  
  e25ffe77532c100c63a9e633ab27fd94724144ad
- SHA256
  
  9ad8f3c941a1f74cf5ea0c6dcc4a873ebdee6ed54cc0474b2cb6fdd8cdb8d539
- SHA512
  
  7988ea9e4b31e587e79c33dec8d06b9aeed2609bbe1c85cf40e414a961683df7f72840526a6d996536a6f5bb9c3e706b1cd161a61028c0b39d30f4ab61576b21
- SSDEEP
  
  49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2H:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy