General

  • Target

    6ab0e23b307730661fb9a2b06bb27d10_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240613-jrgkcszelh

  • MD5

    6ab0e23b307730661fb9a2b06bb27d10

  • SHA1

    bab1fd1570de78ad2204f98c70cb0ed775695cef

  • SHA256

    3e3851b85cbab5647f423924fd3a31fff2a6148edf469e68f7f355b114ed568f

  • SHA512

    8fa4f06466d22766e8bd4b89d3e85ec64c0d81227d1eb9f524e18b30e1e0f032771d775732ad739bda7f9a8c9be5c7c7fd1408a1e87b3097e49f4b07c34fa13e

  • SSDEEP

    49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+viQoo:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY

Malware Config

Targets

    • Target

      6ab0e23b307730661fb9a2b06bb27d10_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      6ab0e23b307730661fb9a2b06bb27d10

    • SHA1

      bab1fd1570de78ad2204f98c70cb0ed775695cef

    • SHA256

      3e3851b85cbab5647f423924fd3a31fff2a6148edf469e68f7f355b114ed568f

    • SHA512

      8fa4f06466d22766e8bd4b89d3e85ec64c0d81227d1eb9f524e18b30e1e0f032771d775732ad739bda7f9a8c9be5c7c7fd1408a1e87b3097e49f4b07c34fa13e

    • SSDEEP

      49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+viQoo:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Command and Control

Web Service

1
T1102

Tasks