General

  • Target

    57b41c91b8a35701651745e876cef8a0_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240525-s3qf3shg47

  • MD5

    57b41c91b8a35701651745e876cef8a0

  • SHA1

    67af87b16fea7064c2a82e35cfc5e35d9d894385

  • SHA256

    1c7aa4678a3e8cc3f804f5fea468829d6e1c237568dc240dc6581436b2fb9923

  • SHA512

    c05e5c6bf1108c9771c3e42a0a4fbb92429cc606367c568f035fe313c5fe3ec6b78eea5169facd71a3b1a83a37d5bd695abf5a5f97a612602ed6d994f8be9757

  • SSDEEP

    49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsNtJViw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd

Malware Config

Targets

    • Target

      57b41c91b8a35701651745e876cef8a0_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      57b41c91b8a35701651745e876cef8a0

    • SHA1

      67af87b16fea7064c2a82e35cfc5e35d9d894385

    • SHA256

      1c7aa4678a3e8cc3f804f5fea468829d6e1c237568dc240dc6581436b2fb9923

    • SHA512

      c05e5c6bf1108c9771c3e42a0a4fbb92429cc606367c568f035fe313c5fe3ec6b78eea5169facd71a3b1a83a37d5bd695abf5a5f97a612602ed6d994f8be9757

    • SSDEEP

      49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsNtJViw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks