Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe
-
Size
271KB
-
MD5
ef6a01bbe16e4b290e4505c86a760cc0
-
SHA1
ea70ad8391858b9cbaa2878f29a03d04d9dcf51b
-
SHA256
f3c4289cf87101e240f6b68ad2a8edde819fb9e50cafc4bfc05b762108c7aaea
-
SHA512
097b278a66c0774c1645f55c5d28d4a935f4beead2f96b0e9f43f347e6ae4fa4b96b3ce3577724362b12f3f4472edaacdc4a7b8d45a5e146a395770dce2a6a0b
-
SSDEEP
3072:9QWpngTJdwJdhD98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2LxX:LVg29GpKbShcHUad
Score
9/10
Malware Config
Signatures
-
Renames multiple (4861) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2228 Zombie.exe 3088 _choco.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\id.pak.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2228 2736 ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe 85 PID 2736 wrote to memory of 2228 2736 ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe 85 PID 2736 wrote to memory of 2228 2736 ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe 85 PID 2736 wrote to memory of 3088 2736 ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe 86 PID 2736 wrote to memory of 3088 2736 ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ef6a01bbe16e4b290e4505c86a760cc0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\_choco.exe"_choco.exe"2⤵
- Executes dropped EXE
PID:3088
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD55cc2f792e4aa51ad5a0a2c6d697e8569
SHA1681687213049502ce550f10aaa811a7f4927e537
SHA256e642deeee9463e31e54607bebdb4277c40f5d80552819d7f008b3ef737d6c24c
SHA5122ff215fe8c1d501eb89b11f4f0a492633ca299292f945091cb378c7180cc8ee4f7e36c2a1c1b2e1b2f0134d927ce1e84a2ae1bf781277aa0e96e9d416af9a3ae
-
Filesize
142KB
MD581a7c181639679983efb07c2dea2ebd0
SHA193370e8e5cb0d89bf6786445f94dd02dbb84b574
SHA2568320c7f90f65b48e4031b680506a9579751789ded4d90fa2fbfc2fb7db7e3ec8
SHA512599cca13e527c92cdf88df06ed8a01eee1bc602c565ab69e251f7414e19833ce42f0453771bfdf27d16f9f70112835b599d26a6ed92901fdf86bbdf8adf4d2f7
-
Filesize
128KB
MD58cc942162229e3c56634f4e29fb2262f
SHA10006acb0e01d4431b2be4e2ab5af1bfb34003ddb
SHA2567ff5129ac146f693f9495882826bf56052fa8033e2c6c785b51cf79df947b96c
SHA5127b5aee80452864328e541ba98e6117c0650194a84a62bb78f7c12201b04e6fe80cb57fd12dcd9378340c25035248489a5f0404c60acabab5ef79d0fd1d85de33