Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a7e86fb65b...cs.exe

windows7-x64

10

a7e86fb65b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe

  • Size

    2.8MB

  • Sample

    240614-gq48xsxfkc

  • MD5

    a7e86fb65bb3a5a014350918cfcca8a0

  • SHA1

    e0b97a4883bf4535b26a1251042355efd8b4af07

  • SHA256

    29fa3d619899c30d01b83d5c24955ada28e6420645672b1fcf31c94f886d706d

  • SHA512

    a7acc5fe8df8431f3a167f0c77f2030131aaa57796f8ed3e15e5b4e96cd9b40937b324bce9a3f866cb054729df38a319679f1f9c1b86ab4ff88713930c236590

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe

    • Size

      2.8MB

    • MD5

      a7e86fb65bb3a5a014350918cfcca8a0

    • SHA1

      e0b97a4883bf4535b26a1251042355efd8b4af07

    • SHA256

      29fa3d619899c30d01b83d5c24955ada28e6420645672b1fcf31c94f886d706d

    • SHA512

      a7acc5fe8df8431f3a167f0c77f2030131aaa57796f8ed3e15e5b4e96cd9b40937b324bce9a3f866cb054729df38a319679f1f9c1b86ab4ff88713930c236590

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

    Score
    10/10
    xmrigexecutionminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks