Overview

overview

10

Static

static

10

60b620e7b4...cs.exe

windows7-x64

10

60b620e7b4...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    60b620e7b43a70c64b0eabf11a38f200_NeikiAnalytics

  • Size

    2.0MB

  • Sample

    240512-dhp79agd42

  • MD5

    60b620e7b43a70c64b0eabf11a38f200

  • SHA1

    bd49daf9d275d818b4ff465ccbe7fa8fcf2b3883

  • SHA256

    7beaf6fd2e7f95c9bbe4f9ca61110f1cf87c5c94ff38c834ce6a20c2d0c7030c

  • SHA512

    a2a236670f419ace5f009cf8637219d04b9e23f6a0b3130c9217837c1e54119cc2ea7052125cb15175fec1f50699d100c3ae530974a2831658d77727d4098b22

  • SSDEEP

    49152:T1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax91MkibTIDiH3gPDwCc:T1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh

Score
10/10
xmrigexecutionminer

Malware Config

Targets

    • Target

      60b620e7b43a70c64b0eabf11a38f200_NeikiAnalytics

    • Size

      2.0MB

    • MD5

      60b620e7b43a70c64b0eabf11a38f200

    • SHA1

      bd49daf9d275d818b4ff465ccbe7fa8fcf2b3883

    • SHA256

      7beaf6fd2e7f95c9bbe4f9ca61110f1cf87c5c94ff38c834ce6a20c2d0c7030c

    • SHA512

      a2a236670f419ace5f009cf8637219d04b9e23f6a0b3130c9217837c1e54119cc2ea7052125cb15175fec1f50699d100c3ae530974a2831658d77727d4098b22

    • SSDEEP

      49152:T1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax91MkibTIDiH3gPDwCc:T1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh

    Score
    10/10
    xmrigexecutionminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks