General

  • Target

    a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe

  • Size

    1.6MB

  • Sample

    240603-pyebgaeg9t

  • MD5

    a3dd8d724792ef23e16e085018787b40

  • SHA1

    4b55b95512d77907ee4304eeb681129ced04b9ca

  • SHA256

    9d4755f3d669454e22a9200f03498c8e918324d040785e3b455b7da9d4bf4ae8

  • SHA512

    2b115a21adeac25ffd5bccab485ff64d3785537a4b22fa8b3f92478011409255c0cbed761bfcc2b0f3bb33caf07f398925895ea30665a43377f9cbc364d7f897

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu1:Lz071uv4BPMkFfdg6NsIRSwV71

Malware Config

Targets

    • Target

      a3dd8d724792ef23e16e085018787b40_NeikiAnalytics.exe

    • Size

      1.6MB

    • MD5

      a3dd8d724792ef23e16e085018787b40

    • SHA1

      4b55b95512d77907ee4304eeb681129ced04b9ca

    • SHA256

      9d4755f3d669454e22a9200f03498c8e918324d040785e3b455b7da9d4bf4ae8

    • SHA512

      2b115a21adeac25ffd5bccab485ff64d3785537a4b22fa8b3f92478011409255c0cbed761bfcc2b0f3bb33caf07f398925895ea30665a43377f9cbc364d7f897

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUu1:Lz071uv4BPMkFfdg6NsIRSwV71

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks