General

  • Target

    1903d379e92879c07eeaa7a67dc85450_NeikiAnalytics.exe

  • Size

    1.7MB

  • Sample

    240610-rclvjaycjg

  • MD5

    1903d379e92879c07eeaa7a67dc85450

  • SHA1

    050aa4c17e11961c57ae25f0d5a36fdad9301e67

  • SHA256

    4c14a83d64f9945d0650e2e7a3a1920643dab0773b29a90dbdfdfa61ea21c29a

  • SHA512

    76617774b379e670b946e6a3e28480d3c9d208fe6f8cb8e1c328b5f9c7836a46180bf809400651d2e6ac462707ec906b7fb4bb50e0abcb4fddcfe982225e31b6

  • SSDEEP

    49152:Lz071uv4BPMkHC0IlnASEx/mi1D+F1E8f:NABA

Malware Config

Targets

    • Target

      1903d379e92879c07eeaa7a67dc85450_NeikiAnalytics.exe

    • Size

      1.7MB

    • MD5

      1903d379e92879c07eeaa7a67dc85450

    • SHA1

      050aa4c17e11961c57ae25f0d5a36fdad9301e67

    • SHA256

      4c14a83d64f9945d0650e2e7a3a1920643dab0773b29a90dbdfdfa61ea21c29a

    • SHA512

      76617774b379e670b946e6a3e28480d3c9d208fe6f8cb8e1c328b5f9c7836a46180bf809400651d2e6ac462707ec906b7fb4bb50e0abcb4fddcfe982225e31b6

    • SSDEEP

      49152:Lz071uv4BPMkHC0IlnASEx/mi1D+F1E8f:NABA

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks