Overview

overview

10

Static

static

10

4a0b0a9fc6...cs.exe

windows7-x64

10

4a0b0a9fc6...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

  • Size

    2.8MB

  • Sample

    240522-162mhsba56

  • MD5

    4a0b0a9fc6ac7a007d688703b8b422f0

  • SHA1

    11d569adbe7965f0e5fa014fb4355d4c1d854c3f

  • SHA256

    5cf7d45c60530f08d735b779e5b20b7048cbbcceff561e071be5bd02acc04d59

  • SHA512

    6d8d5ef89a900093e1598b4f29b9b989010afd52faffc76d430d8366963bacffad112b2815b5356e9aa699a8bc0876953f1411398f19745855581faf47977ecb

  • SSDEEP

    49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6lgVJUwAd0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

    • Size

      2.8MB

    • MD5

      4a0b0a9fc6ac7a007d688703b8b422f0

    • SHA1

      11d569adbe7965f0e5fa014fb4355d4c1d854c3f

    • SHA256

      5cf7d45c60530f08d735b779e5b20b7048cbbcceff561e071be5bd02acc04d59

    • SHA512

      6d8d5ef89a900093e1598b4f29b9b989010afd52faffc76d430d8366963bacffad112b2815b5356e9aa699a8bc0876953f1411398f19745855581faf47977ecb

    • SSDEEP

      49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6lgVJUwAd0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3

    Score
    10/10
    xmrigexecutionminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks