General

  • Target

    8c7cbcc4398fdcdee32200750a35ecc0_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240518-e2wptabh65

  • MD5

    8c7cbcc4398fdcdee32200750a35ecc0

  • SHA1

    9e2d371943d3e1b3f04029f1502ad297d8948bbb

  • SHA256

    4f97033ca7f31ec19974024172ea02b5c92722ae2b7c7c08e1d491b3f7ba09c7

  • SHA512

    fb30935ceab7f8ecf03cd8d2b1da6127c4149889a5cb5532bfccc364df27b86e6baad908c824564fb25ec5c7c1c6e0c8cab0edd3f6d1a80f26c9e8208233ed16

  • SSDEEP

    49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0INx29L5KQ2Q:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra

Malware Config

Targets

    • Target

      8c7cbcc4398fdcdee32200750a35ecc0_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      8c7cbcc4398fdcdee32200750a35ecc0

    • SHA1

      9e2d371943d3e1b3f04029f1502ad297d8948bbb

    • SHA256

      4f97033ca7f31ec19974024172ea02b5c92722ae2b7c7c08e1d491b3f7ba09c7

    • SHA512

      fb30935ceab7f8ecf03cd8d2b1da6127c4149889a5cb5532bfccc364df27b86e6baad908c824564fb25ec5c7c1c6e0c8cab0edd3f6d1a80f26c9e8208233ed16

    • SSDEEP

      49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0INx29L5KQ2Q:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks