Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 15:03

General

  • Target

    21d87a5c58d29772da4c13efeb85feb0_NeikiAnalytics.exe

  • Size

    217KB

  • MD5

    21d87a5c58d29772da4c13efeb85feb0

  • SHA1

    2825706d0ddfe3cbe1d906ae112f06bb4d7a4a8a

  • SHA256

    cc96e7196494378b36f4baf1c43f62198435c3bdb7eaf68a10f24a8efebd5b6c

  • SHA512

    a25a5c05cf519914c256a362f0b8204c78d30e7dcccd9818e01fe39afa947dc3849aa14a044e6f1be186274f17b9948664622a09d61da75f386cb25709cb6585

  • SSDEEP

    3072:+nymCAIuZAIuYSMjoqtMHfhf9fAIuZAIuYSMjoqtMHfhfCTx:JmCAIuZAIuDMVtM/LfAIuZAIuDMVtM/0

Score
9/10

Malware Config

Signatures

  • Renames multiple (315) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21d87a5c58d29772da4c13efeb85feb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\21d87a5c58d29772da4c13efeb85feb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

    Filesize

    217KB

    MD5

    1be7555270d4d18a7cfb089edc2e122d

    SHA1

    ff48b33f0cce4af2f92967a1331170e1947cc527

    SHA256

    8a8cf8aebbe1dc1d195522e98603b236605d1b1ee71ea87942c600fb0b35357f

    SHA512

    65fcc4e44bc93363772377c83b8d4c6a4c5d4004685ff40cb966ba6b289339bad267f2dfaa65aab0a133a0cdb88691f9be4d24996541199c0958441856de4dee

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    226KB

    MD5

    5388db339718f380a3e0f07a8e6cfc19

    SHA1

    6ce03cd39960d2efa768ab2c36ee290ab1267ef5

    SHA256

    daedd19725db79a0cb953086db35f38ee4da6622e9b724f83bdccc2fdc0faceb

    SHA512

    364fa070d70f7dd3c88e0eb7c498a58033ce931e4f9d21e250d1ea0f7033553282b7955456e3ec244508e35f13826134ee715d92804ecf961952979585ffb330

  • memory/2804-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2804-48-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB