Overview

overview

10

Static

static

10

173ad7bfeb...cs.exe

windows7-x64

10

173ad7bfeb...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    173ad7bfeb28d820e88b2655bb8bb2868b01934449f3aba690c9fba41ba6e673_NeikiAnalytics.exe

  • Size

    2.0MB

  • Sample

    240628-zqtfja1hrg

  • MD5

    cb4b981d4395d4c8e4155224ac8f5240

  • SHA1

    8f8c72ec64e63fb5c77daaab3bb674e0b7277f8b

  • SHA256

    173ad7bfeb28d820e88b2655bb8bb2868b01934449f3aba690c9fba41ba6e673

  • SHA512

    8c7ad6be1c16df7863b664ac6096a02cc1779c24934a70a3c7d03177eedeb8c94ab0db8f0b1abba668397f42f045d19e6378f1cac92697d7e21cff3c1d6d34bc

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5I4TNrpDGfFzcVWCB8:NABT

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      173ad7bfeb28d820e88b2655bb8bb2868b01934449f3aba690c9fba41ba6e673_NeikiAnalytics.exe

    • Size

      2.0MB

    • MD5

      cb4b981d4395d4c8e4155224ac8f5240

    • SHA1

      8f8c72ec64e63fb5c77daaab3bb674e0b7277f8b

    • SHA256

      173ad7bfeb28d820e88b2655bb8bb2868b01934449f3aba690c9fba41ba6e673

    • SHA512

      8c7ad6be1c16df7863b664ac6096a02cc1779c24934a70a3c7d03177eedeb8c94ab0db8f0b1abba668397f42f045d19e6378f1cac92697d7e21cff3c1d6d34bc

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5I4TNrpDGfFzcVWCB8:NABT

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks