Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 03:07

General

  • Target

    93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe

  • Size

    100KB

  • MD5

    93ba3372a32601610fcc1115b1cbeed0

  • SHA1

    81176c3587d7ad4f170c43c7159d89813c1125e4

  • SHA256

    6920fbff97890e934f25fce0bbe3c8e6e0039fc8119171220045a39949c1c613

  • SHA512

    a53db24efe16f516c4aa6dcca038a139c50dcfbee34c856644513107f6f11642521fb1c3770961d28e6493c5b7ee27012594c0a808541833fd70618ec676a6a3

  • SSDEEP

    1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf4AI:hfAIuZAIuYSMjoqtMHfhf4hZ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3445) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

    Filesize

    101KB

    MD5

    9cd82ae7611f3071865917a545af9518

    SHA1

    2a6bd669ee9a156b4732179b9b8ef67a26c95717

    SHA256

    92bdda809c85cbc30513afce699e35ca91d8e85805c8f0a439218fe7ebd08729

    SHA512

    6915d8970740ae9d8348c642f0d2e0515ed8d6e7a4068d3927aa80f5fc4c03282fa5f74e301dd732b51897091d5c5621891f9b56b1574b2a8136ec6e1e7d111f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    110KB

    MD5

    443e7163d7ebf642904f053912030f2d

    SHA1

    c73436a4668d646027ca7f5ffd49e2a1770b7e73

    SHA256

    e1a7887626977d7cc92b11aa158ec5c5bd2e156f96ebbe9c1ab82a2d095456a4

    SHA512

    ff02e148e1e58cd79f037683d0be52ef66d03b7b3a296dcada8d729381c89cc3bec748c28b63212279240d66f3a20f22c36b6659362c9c42f53a234166638731

  • memory/2360-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2360-76-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB