Overview

overview

10

Static

static

3

373074c185...cs.exe

windows7-x64

10

373074c185...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    373074c185fd9833aad9264eadd334d0_NeikiAnalytics

  • Size

    5.0MB

  • Sample

    240514-2cndgabd8w

  • MD5

    373074c185fd9833aad9264eadd334d0

  • SHA1

    527cb081418e12590ef8917a07a8f71b5aee400d

  • SHA256

    49ba38711dac1a025ab8dac8fc8fc0b869608afee5728be2ab020211cfbe2fcf

  • SHA512

    c44951bc56cf5f2808a90ab2961fe3110b0ea8fc7c9f477275b0bb18597ad8e417c0b21c59e0e87448a81f2e94a067d90cc24e25a3114b44a35c82e6882be8ef

  • SSDEEP

    24576:aEtl9mRda1VIjCKB8NIyXbacAfUSunEp+XRGEUvkXw6zezNFtcyyRvx+z94sY8L:xEs12dB8NIMI8Sfpwotkzaxc1OGz8L

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      373074c185fd9833aad9264eadd334d0_NeikiAnalytics

    • Size

      5.0MB

    • MD5

      373074c185fd9833aad9264eadd334d0

    • SHA1

      527cb081418e12590ef8917a07a8f71b5aee400d

    • SHA256

      49ba38711dac1a025ab8dac8fc8fc0b869608afee5728be2ab020211cfbe2fcf

    • SHA512

      c44951bc56cf5f2808a90ab2961fe3110b0ea8fc7c9f477275b0bb18597ad8e417c0b21c59e0e87448a81f2e94a067d90cc24e25a3114b44a35c82e6882be8ef

    • SSDEEP

      24576:aEtl9mRda1VIjCKB8NIyXbacAfUSunEp+XRGEUvkXw6zezNFtcyyRvx+z94sY8L:xEs12dB8NIMI8Sfpwotkzaxc1OGz8L

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks