General

  • Target

    0906518960c9f7908543bfb7c3baba50_NeikiAnalytics.exe

  • Size

    1.5MB

  • Sample

    240527-wthlnacg5x

  • MD5

    0906518960c9f7908543bfb7c3baba50

  • SHA1

    655d4427a2f7cd8d111570471960ae7d2def57fa

  • SHA256

    65767b132331d2ab4ab1b9377f71789e144e64ec93fe1c470b6f37889139de7e

  • SHA512

    1d078c69437a52a2e290ed7133b807aca7c97c9e6db8aa6aac007ab2787e47802fec533570d9d0d1ab0d20e26ada4bbc58ebdc330417b9c19742954f84e8a88a

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCU5KYaK:Lz071uv4BPMki8Cnki2WGcNLaEK

Malware Config

Targets

    • Target

      0906518960c9f7908543bfb7c3baba50_NeikiAnalytics.exe

    • Size

      1.5MB

    • MD5

      0906518960c9f7908543bfb7c3baba50

    • SHA1

      655d4427a2f7cd8d111570471960ae7d2def57fa

    • SHA256

      65767b132331d2ab4ab1b9377f71789e144e64ec93fe1c470b6f37889139de7e

    • SHA512

      1d078c69437a52a2e290ed7133b807aca7c97c9e6db8aa6aac007ab2787e47802fec533570d9d0d1ab0d20e26ada4bbc58ebdc330417b9c19742954f84e8a88a

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQulY043mWELcWV5jGWQlmCU5KYaK:Lz071uv4BPMki8Cnki2WGcNLaEK

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks