General

  • Target

    7d9cae2d6cae45fb016484a3aa18afb0_NeikiAnalytics.exe

  • Size

    1.6MB

  • Sample

    240523-th3rcagf79

  • MD5

    7d9cae2d6cae45fb016484a3aa18afb0

  • SHA1

    dbff3ad4b2e1301187b2c95ff050a2be1ed6a442

  • SHA256

    93e80cf6e9baa7249b26b9e49c81763e0e8725a0f272228c588774ccd4dc24de

  • SHA512

    9c36f7919f03271188056179d82c33d3f29fe22b771ada142beafe64d845e4c3be6c4a28649832d7673752bfdac5387b65ddce7d22238b755729821c83fe8302

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXsLq9UaT:Lz071uv4BPMkHC0IaSEzQR4iRLUUaaY

Malware Config

Targets

    • Target

      7d9cae2d6cae45fb016484a3aa18afb0_NeikiAnalytics.exe

    • Size

      1.6MB

    • MD5

      7d9cae2d6cae45fb016484a3aa18afb0

    • SHA1

      dbff3ad4b2e1301187b2c95ff050a2be1ed6a442

    • SHA256

      93e80cf6e9baa7249b26b9e49c81763e0e8725a0f272228c588774ccd4dc24de

    • SHA512

      9c36f7919f03271188056179d82c33d3f29fe22b771ada142beafe64d845e4c3be6c4a28649832d7673752bfdac5387b65ddce7d22238b755729821c83fe8302

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXsLq9UaT:Lz071uv4BPMkHC0IaSEzQR4iRLUUaaY

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks