xmrig | a67bf64590801725ddc76f2fb5e2a1b94150f93db49d2154f182794804130d13

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe
Size

2.0MB
MD5

b405e65fbcf246b3f27f4ab48d7af770
SHA1

68ece200b6a1fe1e8d42a2a7800471d9498514d1
SHA256

a67bf64590801725ddc76f2fb5e2a1b94150f93db49d2154f182794804130d13
SHA512

ad5120b22d4fd71a9c836f530556a30cf5889a846f285d9f4fe2331e4fcf70e716d6dee1d9944856bb660cbfcc9632a9c4bbe3bf5ef345ddc6f0281728dacb30
SSDEEP

49152:/cGtojLjDfs+wzAqV2ySKcFdObg914AusWSO9vMsA4LmeNh/KKlUm3ee:jUfs+/qwybcnD914fsrO91fLm0hC0

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/768-1-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/768-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/4892-23-0x0000000000400000-0x0000000000582000-memory.dmp	xmrig
behavioral2/memory/4892-28-0x0000000025820000-0x00000000259B3000-memory.dmp	xmrig
behavioral2/memory/4892-29-0x0000000000400000-0x000000000057C000-memory.dmp	xmrig
behavioral2/memory/4892-38-0x0000000025B40000-0x0000000025CC2000-memory.dmp	xmrig
behavioral2/memory/4892-39-0x0000000000400000-0x0000000000A7A000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4892	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4892	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/768-0-0x0000000000400000-0x0000000000A7A000-memory.dmp	upx
behavioral2/files/0x000900000002339a-13.dat	upx
behavioral2/memory/4892-21-0x0000000000400000-0x0000000000A7A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
768	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4892	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4892	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
768	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe
4892	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4892	768	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe	82
PID 768 wrote to memory of 4892	768	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe	82
PID 768 wrote to memory of 4892	768	b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b405e65fbcf246b3f27f4ab48d7af770_NeikiAnalytics.exe

Filesize
2.0MB

MD5
db2d3079fb077b23a5a4f0c2f01d6254

SHA1
7fec161110f6d878769d42435cf7efbce2aaefe9

SHA256
266e7a7ec2b0f54559c7ae9c424fe83d6915c553c341c019ea2b40a0cd4f1bd6

SHA512
f9abd744252ecb6086081c7a421a24fe1a8f2584c43e63834885b3967cdd4277840327833e0eb476677fdd63dbf3cf90d6c43adae70eaa9be586b206efad30d4

Download Submit
memory/768-0-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/768-1-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/768-7-0x0000000021E90000-0x000000002202E000-memory.dmp

Filesize
1.6MB

Download
memory/768-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/4892-21-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download
memory/4892-22-0x0000000021E40000-0x0000000021FDE000-memory.dmp

Filesize
1.6MB

Download
memory/4892-23-0x0000000000400000-0x0000000000582000-memory.dmp

Filesize
1.5MB

Download
memory/4892-28-0x0000000025820000-0x00000000259B3000-memory.dmp

Filesize
1.6MB

Download
memory/4892-29-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/4892-38-0x0000000025B40000-0x0000000025CC2000-memory.dmp

Filesize
1.5MB

Download
memory/4892-39-0x0000000000400000-0x0000000000A7A000-memory.dmp

Filesize
6.5MB

Download