Overview

overview

10

Static

static

10

715cdcb182...cs.exe

windows7-x64

10

715cdcb182...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    715cdcb18203bee224005b63c8af2f30_NeikiAnalytics.exe

  • Size

    2.2MB

  • Sample

    240523-b85phshc8w

  • MD5

    715cdcb18203bee224005b63c8af2f30

  • SHA1

    0566fd211d0c1343cb3da8af0c442d84bac40792

  • SHA256

    3929cbd3a2c041efe16e7cab00f3d4fc750b5ac30fcb5eda617a12479adbfe03

  • SHA512

    75bdce78fc917b214fd0b337202d4782dc559dbe3bd0cfe03b185a35fa95c010626d2bdd109f4eb3e5435d95d3efea00635d35ba8088314ad07cf713ce9728dd

  • SSDEEP

    49152:S0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8Dhqd+XRqTr8B:S0GnJMOWPClFdx6e0EALKWVTffZiPAcK

Score
10/10
xmrigminer

Malware Config

Targets

    • Target

      715cdcb18203bee224005b63c8af2f30_NeikiAnalytics.exe

    • Size

      2.2MB

    • MD5

      715cdcb18203bee224005b63c8af2f30

    • SHA1

      0566fd211d0c1343cb3da8af0c442d84bac40792

    • SHA256

      3929cbd3a2c041efe16e7cab00f3d4fc750b5ac30fcb5eda617a12479adbfe03

    • SHA512

      75bdce78fc917b214fd0b337202d4782dc559dbe3bd0cfe03b185a35fa95c010626d2bdd109f4eb3e5435d95d3efea00635d35ba8088314ad07cf713ce9728dd

    • SSDEEP

      49152:S0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8Dhqd+XRqTr8B:S0GnJMOWPClFdx6e0EALKWVTffZiPAcK

    Score
    10/10
    xmrigminer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks