General

  • Target

    925947881e612d3d433dcbabe7c41a80_NeikiAnalytics.exe

  • Size

    5.3MB

  • Sample

    240614-ae8nmsxamc

  • MD5

    925947881e612d3d433dcbabe7c41a80

  • SHA1

    e0b94bf51b5e7b98c2acff1e796e2e155fd6ec59

  • SHA256

    3f87a1f73d95fc7c74a88ca8d5114b633ff99396275c175d5dd2ebb5ca25721f

  • SHA512

    6c59cafe347a7c20c50473cdee0bb08bde60b5bf727ffc1388e7e8ebd8033c012f496688d68a76c057d2b08e42834a2c16a207b6285afffb2999a04dcd7c9341

  • SSDEEP

    98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7

Malware Config

Targets

    • Target

      925947881e612d3d433dcbabe7c41a80_NeikiAnalytics.exe

    • Size

      5.3MB

    • MD5

      925947881e612d3d433dcbabe7c41a80

    • SHA1

      e0b94bf51b5e7b98c2acff1e796e2e155fd6ec59

    • SHA256

      3f87a1f73d95fc7c74a88ca8d5114b633ff99396275c175d5dd2ebb5ca25721f

    • SHA512

      6c59cafe347a7c20c50473cdee0bb08bde60b5bf727ffc1388e7e8ebd8033c012f496688d68a76c057d2b08e42834a2c16a207b6285afffb2999a04dcd7c9341

    • SSDEEP

      98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Stops running service(s)

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Impact

Service Stop

1
T1489

Tasks