General

  • Target

    2b70963aed3852aa77c4b22514cd5020_NeikiAnalytics.exe

  • Size

    2.0MB

  • Sample

    240522-p585escb9t

  • MD5

    2b70963aed3852aa77c4b22514cd5020

  • SHA1

    90487037ee549207a60d7712fda50c4b9cb9f6bf

  • SHA256

    3c0cef961914d85de559e98e7fb725e8819736f569d05e2776aa06441b1d87f0

  • SHA512

    3683d92f6cecce054e74305a2520ad6b89564c2beaf0f4d694364c5fdb150fd98b7a5226c4f26653c0510b4882a44d1ec2982fca21c18ae6fbca645dc36ae2bf

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo/Z:NABI

Malware Config

Targets

    • Target

      2b70963aed3852aa77c4b22514cd5020_NeikiAnalytics.exe

    • Size

      2.0MB

    • MD5

      2b70963aed3852aa77c4b22514cd5020

    • SHA1

      90487037ee549207a60d7712fda50c4b9cb9f6bf

    • SHA256

      3c0cef961914d85de559e98e7fb725e8819736f569d05e2776aa06441b1d87f0

    • SHA512

      3683d92f6cecce054e74305a2520ad6b89564c2beaf0f4d694364c5fdb150fd98b7a5226c4f26653c0510b4882a44d1ec2982fca21c18ae6fbca645dc36ae2bf

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo/Z:NABI

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks