Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe
-
Size
247KB
-
MD5
2f473f08c5cf58ddd38da0b6f873bfc0
-
SHA1
0f4fbcf1e2012a9bb8fdd1264744345c15f2f154
-
SHA256
b4b34264d0836a48f650baeb718aa06f91302a95313152a9bce6e0f1d2a6beed
-
SHA512
d5e5a96ee8518c980225b06bd63581bad50b9d6b3542d87b46efae1070c1803e872f332ee95a065e45460c5d470f229a138bf46e2ee228a435f5d55ecec41b56
-
SSDEEP
3072:6e7WpHIyRF9ESWu0SWuDmSXrwcysSSw9mHpKZNGCLOwstyhZFChcssc56FUrgxvI:RqlIyFESWu0SWuTSh9UpK7ShcHUaZ0
Score
9/10
Malware Config
Signatures
-
Renames multiple (4831) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 5040 Zombie.exe 2744 _cinst.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe File created C:\Windows\SysWOW64\Zombie.exe 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fil.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1940 wrote to memory of 5040 1940 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe 84 PID 1940 wrote to memory of 5040 1940 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe 84 PID 1940 wrote to memory of 5040 1940 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe 84 PID 1940 wrote to memory of 2744 1940 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe 85 PID 1940 wrote to memory of 2744 1940 2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\2f473f08c5cf58ddd38da0b6f873bfc0_NEIKI.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\_cinst.exe"_cinst.exe"2⤵
- Executes dropped EXE
PID:2744
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5148ac1f1aeba355965fbe2f30f111b28
SHA112362d82c595bcde7f832d5aeced70cd75f074d2
SHA256a2473cdb8575f68b6eeb75865ad61540aa557dc75089f9227ecad19a10236c0e
SHA512a42b87a06209ea20f98ff8d108ff8c01673ebe9a5d4e33fc2c914bc2a7a46c543e3b59838b8267d4445ec11a83d39ac66b9efb1019fed90f8777b54f1f4339d2
-
Filesize
143KB
MD52fdb371d45181dff59577110ba1064e2
SHA142a5833cb0ac90e38d734d1327bb3f7c7a6aa453
SHA25680d7ec8ce3913d81ea5d4f304b8609e56f0e49778c52af9279e742ea54f4a155
SHA51252982041ba9ca552b90b79b251501ec6c33c5251d09ca9969a1b179af2ec17aca6eb81db6e588e12751bcea04208e1da8d5a754a979dd98ceb3f50780aadea20
-
Filesize
104KB
MD53cd001c929674ac992bd180f9ebf49ae
SHA1c921f08d5eb02e27fcc04be5a9abab434bff14e7
SHA256cd9598f195cd63c3f24d3457fa0f400cdeae1a140312972e5975e4d3ab65783d
SHA51281eb0d8d7ffa0985ec50d95832c3ba4a6a858e3f2ca947e4c1c8c6189a1489ad55b01e409245b0dc1623b0ca88707ca06dbdbfc000a85c70c8aff37e351ba4a0