Overview

overview

10

Static

static

10

daa173d32a...cs.exe

windows7-x64

10

daa173d32a...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe

  • Size

    1.5MB

  • Sample

    240517-j7xlhshd87

  • MD5

    daa173d32ac3a438da8c8b1ff3d77fe0

  • SHA1

    48c40d9c8e845b974523ea869631adee4496c42e

  • SHA256

    cbadab8bf269b316f2f5d608829ad2d41fed41e952c770853e6e2d24203dafd8

  • SHA512

    de7f54618f83070d12aba031c4a5e445005d1657b1f6f61455d4e13f02b347cc54824ae116d23fcd3661c32032f7d1205e93b833ab7c990f109d7c8a377f4025

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5eSh0eKITNEZ:Lz071uv4BPMkyW10/wKV7hjSeShTw

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe

    • Size

      1.5MB

    • MD5

      daa173d32ac3a438da8c8b1ff3d77fe0

    • SHA1

      48c40d9c8e845b974523ea869631adee4496c42e

    • SHA256

      cbadab8bf269b316f2f5d608829ad2d41fed41e952c770853e6e2d24203dafd8

    • SHA512

      de7f54618f83070d12aba031c4a5e445005d1657b1f6f61455d4e13f02b347cc54824ae116d23fcd3661c32032f7d1205e93b833ab7c990f109d7c8a377f4025

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5eSh0eKITNEZ:Lz071uv4BPMkyW10/wKV7hjSeShTw

    Score
    10/10
    xmrigexecutionminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks