2c7fb5dfb9846b7da82d9bbab74ce56d77e739576be42490b0d9d99bffcc1a86

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe
Size

92KB
MD5

82e79b09a6cecca253a51635238fb3b0
SHA1

a85ce551f01f3cbf9e7bcbb5ab11ffc2af14b424
SHA256

2c7fb5dfb9846b7da82d9bbab74ce56d77e739576be42490b0d9d99bffcc1a86
SHA512

2b6faccf8716496ca059bb7fba749fb744a96f1f64ffa55bec5fa5eabf8f4b9b6b8f8e98f3bcc853b452ad06efdf757ee5d657484c997654097f9d98a065dc7a
SSDEEP

1536:W7ZDpApYbWjCDOwr0ARZF6NFVogjQlRv/Lq:6DWpeDOBwUhQ7XO

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3530) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3044	_checksum.exe
1912	Zombie.exe

Loads dropped DLL 3 IoCs

pid	Process
2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe
2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe
2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	Zombie.exe
File created	C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3044	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 3044	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 3044	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 3044	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 1912	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	30
PID 2368 wrote to memory of 1912	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	30
PID 2368 wrote to memory of 1912	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	30
PID 2368 wrote to memory of 1912	2368	82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe	30

C:\Users\Admin\AppData\Local\Temp\82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\82e79b09a6cecca253a51635238fb3b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\_checksum.exe
  "_checksum.exe"
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
57KB

MD5
2ebd044382d911878effb565fbf1506d

SHA1
226344efaab9282221b58f795fb46090c652bbfd

SHA256
afcf9eb1b7fda13430367bf50b9cbfe725903b1266feda0d7ba92e5e474a99c2

SHA512
00be0ad056502a6fce4c763b0f9506f45d0aabeac756aa09980ab58ab39afc58fd4f103317bdcdd39727c915f1b0d8690dcf0d387bb30b9476bf1ac5effcea37

Download Submit
\Users\Admin\AppData\Local\Temp\_checksum.exe

Filesize
35KB

MD5
23f049f14ca0e68af4b9883514791dfe

SHA1
1224ecfda221e54d4536a4ac102a56235320ee25

SHA256
9562aabe1f71d7ff5ec879fd2fb5cfe4be2c8f62a7fa5a1aa49660c3a495f1fb

SHA512
ce91cd089a299ba88f047cf15fd06673389942dabbf8be5bf2e2666e1048bc6da261ce30cae1e2ecb3b50392441a335bf97cc4ed51540554bedabe65590be677

Download Submit
\Windows\SysWOW64\Zombie.exe

Filesize
56KB

MD5
422ffd6d973cb221569512f8a86271ea

SHA1
7557de07f388720dfc713900c35bf71470208df4

SHA256
42d9af2aef554c334d1f361a5d2843f80a435cbddd51682f26a3b9cc14657bd6

SHA512
f08fe1e4627488ff45388289de1634386b21fd39ceacb93668a1aff54fa074d5ba383eb1c1133f21965d866e0c6f27cd8a91210537b6357495dd9e1eec845e13

Download Submit
memory/3044-19-0x000007FEF5C43000-0x000007FEF5C44000-memory.dmp

Filesize
4KB

Download
memory/3044-22-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/3044-27-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-654-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download