Overview

overview

10

Static

static

3

21353d65b4...cs.exe

windows7-x64

10

21353d65b4...cs.exe

windows10-2004-x64

10

Resubmissions

16/07/2024, 16:17

240716-trljes1akl 10

16/07/2024, 16:15

240716-tqbb3azhpn 10

17/05/2024, 19:31

240517-x8wmhafa6s 10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 19:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe

  • Size

    6.0MB

  • MD5

    21353d65b457518570bffc8a03038ee0

  • SHA1

    b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d

  • SHA256

    98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39

  • SHA512

    a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282

  • SSDEEP

    98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS

Score
10/10
evasionransomwarespywarestealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\HOW_TO_RECOVER_FILES.txt

Ransom Note
Your network has been chosen for Security Audit by EMBARGO Team. We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems. You must contact us before the deadline 2024-05-21 06:25:37 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/ Do not modify any files or file extensions. Your data maybe lost forever. Instructions: 1. Download torbrowser: https://www.torproject.org/download/ 2. Go to your registration link: ================================= http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8 ================================= 3. Register an account then login If you have problems with this instructions, you can contact us on TOX: 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47 After payment for our services, you will receive: - decrypt app for all systems - proof that we delete your data from our systems - full detail pentest report - 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan IMPORTANT: After 2024-05-21 06:25:37 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed. If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers. WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators. If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.
URLs

http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/

http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Renames multiple (8167) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /c bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /c ping localhost -n 5 > nul & del C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
      2⤵
        PID:1088
        • C:\Windows\SysWOW64\PING.EXE
          ping localhost -n 5
          3⤵
          • Runs ping.exe
          PID:1980

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G6IJ9X2J\fwlink[1].564ba1.partial
      Filesize

      160B

      MD5

      4d45b4ece197f53cbe3f17cdbb1af049

      SHA1

      e2d1630734b70dd94cdfd8cd71a7f443681bab56

      SHA256

      c07ec3ed27760275dbb1ac91c5e1bea336fea8fc02c5929a29facd45374ff154

      SHA512

      271c7987fa319bb0297a37a174461837a4b9158018511b7ae532eaf0fb00b429789b42dcab6293bd38a124b9f0d3e46511fc75fa621829bb537a8d33a696cbfb

      Download Submit

    • F:\$RECYCLE.BIN\HOW_TO_RECOVER_FILES.txt
      Filesize

      1KB

      MD5

      760746c6bc18a85e7503567571fa6d8a

      SHA1

      0dfdce0bbc0c3aa4fa0507c40d4c14968fb28834

      SHA256

      a9db836bdbf007aa6b13cfb9ad280be457138db4464990356d682128c3d2a0be

      SHA512

      ff3f665660147120ba66bdbe472841a7f96daa81ca760c36c79cafa8216d5e8eb097f202ebfde5e0dc9ab761fb2ce72b3fb09aa854c872f9961e8f388f097ee7

      Download Submit

    • memory/1372-14347-0x0000000001190000-0x00000000017A0000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1372-25890-0x0000000001190000-0x00000000017A0000-memory.dmp

      Filesize

      6.1MB

      Download