General

  • Target

    2136e43ed39190c62a36988141daf3f0_NeikiAnalytics.exe

  • Size

    2.6MB

  • Sample

    240527-ghr9dsab41

  • MD5

    2136e43ed39190c62a36988141daf3f0

  • SHA1

    01c3443e8899882759cfba8d765b841210fc04a8

  • SHA256

    31009610bd1eddee20f3cdae2b3eede528b9575565bdca5ac7bdf853f91a64e9

  • SHA512

    e649dc596dab4220f29fbacd42fdc69b00ed13504f8c800922a3524272fa51b2cfe6cc58228ff2437bdfc40f3d04987a2a266e208017c71cfca92b9d772f4dc0

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMk+QqGRjj3LJR/L2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1

Malware Config

Targets

    • Target

      2136e43ed39190c62a36988141daf3f0_NeikiAnalytics.exe

    • Size

      2.6MB

    • MD5

      2136e43ed39190c62a36988141daf3f0

    • SHA1

      01c3443e8899882759cfba8d765b841210fc04a8

    • SHA256

      31009610bd1eddee20f3cdae2b3eede528b9575565bdca5ac7bdf853f91a64e9

    • SHA512

      e649dc596dab4220f29fbacd42fdc69b00ed13504f8c800922a3524272fa51b2cfe6cc58228ff2437bdfc40f3d04987a2a266e208017c71cfca92b9d772f4dc0

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMk+QqGRjj3LJR/L2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks