Overview

overview

9

Static

static

3

2f473f08c5...KI.exe

windows7-x64

9

2f473f08c5...KI.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe

  • Size

    247KB

  • MD5

    2f473f08c5cf58ddd38da0b6f873bfc0

  • SHA1

    0f4fbcf1e2012a9bb8fdd1264744345c15f2f154

  • SHA256

    b4b34264d0836a48f650baeb718aa06f91302a95313152a9bce6e0f1d2a6beed

  • SHA512

    d5e5a96ee8518c980225b06bd63581bad50b9d6b3542d87b46efae1070c1803e872f332ee95a065e45460c5d470f229a138bf46e2ee228a435f5d55ecec41b56

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmSXrwcysSSw9mHpKZNGCLOwstyhZFChcssc56FUrgxvI:RqlIyFESWu0SWuTSh9UpK7ShcHUaZ0

Score
9/10
ransomware

Malware Config

Signatures

  • Renames multiple (284) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Local\Temp\_cinst.exe
      "_cinst.exe"
      2⤵
      • Executes dropped EXE
      PID:2948
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp
    Filesize

    105KB

    MD5

    8abbdcdb0d9c180964f9499d36ba96e2

    SHA1

    1a200da42476deb0273b9fe300c83f7c756735d5

    SHA256

    ea93a7799fb4a64b83ad354834964d7e5c2d2f860bcf67af8f4d11d7600cf697

    SHA512

    d5b7174a93b715c5cbdcf5b5de00d989da9dd81770acc3de706ac1c883a89403a37338ab7974f748e11f0b179276a472edec815e520e2ea60b13458c8b64c049

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_cinst.exe
    Filesize

    143KB

    MD5

    2fdb371d45181dff59577110ba1064e2

    SHA1

    42a5833cb0ac90e38d734d1327bb3f7c7a6aa453

    SHA256

    80d7ec8ce3913d81ea5d4f304b8609e56f0e49778c52af9279e742ea54f4a155

    SHA512

    52982041ba9ca552b90b79b251501ec6c33c5251d09ca9969a1b179af2ec17aca6eb81db6e588e12751bcea04208e1da8d5a754a979dd98ceb3f50780aadea20

    Download Submit

  • \Windows\SysWOW64\Zombie.exe
    Filesize

    104KB

    MD5

    3cd001c929674ac992bd180f9ebf49ae

    SHA1

    c921f08d5eb02e27fcc04be5a9abab434bff14e7

    SHA256

    cd9598f195cd63c3f24d3457fa0f400cdeae1a140312972e5975e4d3ab65783d

    SHA512

    81eb0d8d7ffa0985ec50d95832c3ba4a6a858e3f2ca947e4c1c8c6189a1489ad55b01e409245b0dc1623b0ca88707ca06dbdbfc000a85c70c8aff37e351ba4a0

    Download Submit

  • memory/2948-19-0x000007FEF5D33000-0x000007FEF5D34000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-20-0x00000000000A0000-0x00000000000C8000-memory.dmp

    Filesize

    160KB

    Download