General

  • Target

    66a4ad4b6f40960f2b56a82bab31c00975ef880aec322aaafcafca16e7376e75_NeikiAnalytics.exe

  • Size

    1.7MB

  • Sample

    240628-cvl6payflm

  • MD5

    2eb687e3b469236822f562cb175d4f80

  • SHA1

    37e29e67baaf5063607e152f6d801f224d068bb2

  • SHA256

    66a4ad4b6f40960f2b56a82bab31c00975ef880aec322aaafcafca16e7376e75

  • SHA512

    645bdea59385ea078d7bfb3ac312d96ce74ad802e9df9bb5ecf84fe4eeeb24f550aaf1fc35e4b8e0f45246ae0c1aeb3600c878d3ce8f0bab56bfc8d3f1d7fe79

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6DBvSArT4xtQHRv:Lz071uv4BPMkFfdk2af+vP4nQHt

Malware Config

Targets

    • Target

      66a4ad4b6f40960f2b56a82bab31c00975ef880aec322aaafcafca16e7376e75_NeikiAnalytics.exe

    • Size

      1.7MB

    • MD5

      2eb687e3b469236822f562cb175d4f80

    • SHA1

      37e29e67baaf5063607e152f6d801f224d068bb2

    • SHA256

      66a4ad4b6f40960f2b56a82bab31c00975ef880aec322aaafcafca16e7376e75

    • SHA512

      645bdea59385ea078d7bfb3ac312d96ce74ad802e9df9bb5ecf84fe4eeeb24f550aaf1fc35e4b8e0f45246ae0c1aeb3600c878d3ce8f0bab56bfc8d3f1d7fe79

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6DBvSArT4xtQHRv:Lz071uv4BPMkFfdk2af+vP4nQHt

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks