General

  • Target

    1a104d6cce1caea5819422b78daaf770_NeikiAnalytics.exe

  • Size

    1.8MB

  • Sample

    240610-r1bz8szfpr

  • MD5

    1a104d6cce1caea5819422b78daaf770

  • SHA1

    0631d71e4ab702d78f4ee016a33aa315ed3bbeeb

  • SHA256

    60161366aedf99171e4ce39e8bfbc45d6677c47106c177c597621510ebd2d8c0

  • SHA512

    c8643ede42a2f5e398f6242b263cdc43fdcdca0cdc2c56b4e45b712569039ca0407727b2676ba70274d47ac75ede383a61eac45708d589af5c8cff85128e71e4

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt0:Lz071uv4BPMkibTIA5I4TNrpDGgDQ9vW

Malware Config

Targets

    • Target

      1a104d6cce1caea5819422b78daaf770_NeikiAnalytics.exe

    • Size

      1.8MB

    • MD5

      1a104d6cce1caea5819422b78daaf770

    • SHA1

      0631d71e4ab702d78f4ee016a33aa315ed3bbeeb

    • SHA256

      60161366aedf99171e4ce39e8bfbc45d6677c47106c177c597621510ebd2d8c0

    • SHA512

      c8643ede42a2f5e398f6242b263cdc43fdcdca0cdc2c56b4e45b712569039ca0407727b2676ba70274d47ac75ede383a61eac45708d589af5c8cff85128e71e4

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt0:Lz071uv4BPMkibTIA5I4TNrpDGgDQ9vW

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks