General

  • Target

    0687736c1a39f20a3fd9f39d319eb840_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240525-w1j33add2z

  • MD5

    0687736c1a39f20a3fd9f39d319eb840

  • SHA1

    a392ad548037f5930eddd6c0eb637efe687f466b

  • SHA256

    7afdd931474a8058c0e162bee5d22125b041068fe4981d19800e1ea544394537

  • SHA512

    dbe816b50da5d9fddba786bb51bcd3264a3087ee119a3c2831a90b1f420737af19014b3994063f89b69a9f59f3f79c2b5cb41fdee338e9cc3362eb51753761fd

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY

Malware Config

Targets

    • Target

      0687736c1a39f20a3fd9f39d319eb840_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      0687736c1a39f20a3fd9f39d319eb840

    • SHA1

      a392ad548037f5930eddd6c0eb637efe687f466b

    • SHA256

      7afdd931474a8058c0e162bee5d22125b041068fe4981d19800e1ea544394537

    • SHA512

      dbe816b50da5d9fddba786bb51bcd3264a3087ee119a3c2831a90b1f420737af19014b3994063f89b69a9f59f3f79c2b5cb41fdee338e9cc3362eb51753761fd

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks