General

  • Target

    6a13f37c2990631f88343e9f9a014e20_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240613-jk2lyszcpa

  • MD5

    6a13f37c2990631f88343e9f9a014e20

  • SHA1

    ad9d61e0471647caed7db08227509da0f8eeefb1

  • SHA256

    57ded2a4e56fba263a9b2ceda99d7f0b497be39f86a70a5c04ba3a4e5b7149a1

  • SHA512

    73e717c58f7a744fe69334ac6c5ee4ab884a7ebf4268128e0c29024f440d32c647eb23292697065a6c5a766364b7fa4141c7fd656ad4df370681a629697f93b3

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhQz:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC

Malware Config

Targets

    • Target

      6a13f37c2990631f88343e9f9a014e20_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      6a13f37c2990631f88343e9f9a014e20

    • SHA1

      ad9d61e0471647caed7db08227509da0f8eeefb1

    • SHA256

      57ded2a4e56fba263a9b2ceda99d7f0b497be39f86a70a5c04ba3a4e5b7149a1

    • SHA512

      73e717c58f7a744fe69334ac6c5ee4ab884a7ebf4268128e0c29024f440d32c647eb23292697065a6c5a766364b7fa4141c7fd656ad4df370681a629697f93b3

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhQz:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Tasks