Overview

overview

10

Static

static

10

9ff0fae512...cs.exe

windows7-x64

10

9ff0fae512...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9ff0fae51209819f3449f1918280e320_NeikiAnalytics

  • Size

    1.4MB

  • Sample

    240511-jevapage94

  • MD5

    9ff0fae51209819f3449f1918280e320

  • SHA1

    9028681c9abde53e6459378c5fcf37c5bc33a562

  • SHA256

    eb41bf7c77fe81144e8be3d8532a5382545100cf007799b604f95dae35b06340

  • SHA512

    d7a8531eef9d97417692a9ec41d0ad2f04172c95129892e241125cf643a7a2082e3e8ed7ed9d2cb84fe5014d1e853883ebeb6ca92a41be73030afd0c57ee2181

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbf+Bogs:Lz071uv4BPMkHC0IlnASEx/mlT

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      9ff0fae51209819f3449f1918280e320_NeikiAnalytics

    • Size

      1.4MB

    • MD5

      9ff0fae51209819f3449f1918280e320

    • SHA1

      9028681c9abde53e6459378c5fcf37c5bc33a562

    • SHA256

      eb41bf7c77fe81144e8be3d8532a5382545100cf007799b604f95dae35b06340

    • SHA512

      d7a8531eef9d97417692a9ec41d0ad2f04172c95129892e241125cf643a7a2082e3e8ed7ed9d2cb84fe5014d1e853883ebeb6ca92a41be73030afd0c57ee2181

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbf+Bogs:Lz071uv4BPMkHC0IlnASEx/mlT

    Score
    10/10
    xmrigexecutionminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks