Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 20:02

General

  • Target

    e4c928c662efc5f15fa0f73ff85a8090_NeikiAnalytics.exe

  • Size

    77KB

  • MD5

    e4c928c662efc5f15fa0f73ff85a8090

  • SHA1

    88a2133dbea6591ef67d54ad7bf7b05a9a51f97a

  • SHA256

    29b11fb2f8ff8206e1d47c76bdc0852f3031689a07bca5c9dcce439f73eaed8c

  • SHA512

    71baf866493b97cbea7a86589cd042a8e1ad238e16148e5e1404d881a270125bdf2b75c5044c39e9436293b6c7f50da13ee5128efbd494c80ffd6d1ef76df802

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/M:6e7WpMaxeb0CYJ97lEYNR73e+eKZM

Score
9/10

Malware Config

Signatures

  • Renames multiple (5038) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4c928c662efc5f15fa0f73ff85a8090_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e4c928c662efc5f15fa0f73ff85a8090_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    1987f0d540e71f958daa43b54ddf274d

    SHA1

    b1a50e3dc0c2d01adbcbd8b8a71f2b2fcea1b8ea

    SHA256

    464eaec4f90288b8465b1b52b667ac428761174c914afa56944c7dbe2f401886

    SHA512

    71e0b88fc8c001a01c4a8318ad7a012df1f824fb395475c166314884bf8f2c3695f6b811782be549d72b4d2a1b26b05fb23f51bd6aebab08337aa3cdb7fd46bf

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    176KB

    MD5

    d198ddb90df8cb8ee3686fa786095a1e

    SHA1

    3efc4e7ee4d23e09ec69e73ffa906106c31d198b

    SHA256

    bae37f1ed252ee030b461038c5e662827df90b5c8d0f3939e4a9de1fff8b906e

    SHA512

    7c640830780209fa6173d895e8b8ee0b420c295b4050ca1b43230ab180ec30f58d820223d30c94bf0b6e29c86e4d749b61bd966e4c547e345ea0fe8567baba7b