Overview

overview

10

Static

static

3

21353d65b4...cs.exe

windows7-x64

10

21353d65b4...cs.exe

windows10-2004-x64

10

Resubmissions

16/07/2024, 16:17

240716-trljes1akl 10

16/07/2024, 16:15

240716-tqbb3azhpn 10

17/05/2024, 19:31

240517-x8wmhafa6s 10

Analysis

  • max time kernel
    115s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 19:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe

  • Size

    6.0MB

  • MD5

    21353d65b457518570bffc8a03038ee0

  • SHA1

    b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d

  • SHA256

    98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39

  • SHA512

    a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282

  • SSDEEP

    98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS

Score
10/10
evasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\HOW_TO_RECOVER_FILES.txt

Ransom Note
Your network has been chosen for Security Audit by EMBARGO Team. We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems. You must contact us before the deadline 2024-05-21 06:25:37 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/ Do not modify any files or file extensions. Your data maybe lost forever. Instructions: 1. Download torbrowser: https://www.torproject.org/download/ 2. Go to your registration link: ================================= http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8 ================================= 3. Register an account then login If you have problems with this instructions, you can contact us on TOX: 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47 After payment for our services, you will receive: - decrypt app for all systems - proof that we delete your data from our systems - full detail pentest report - 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan IMPORTANT: After 2024-05-21 06:25:37 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed. If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers. WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators. If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.
URLs

http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/

http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Renames multiple (7328) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /c bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4396
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /c ping localhost -n 5 > nul & del C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:8740
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 5
        3⤵
        • Runs ping.exe
        PID:8416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\HOW_TO_RECOVER_FILES.txt
    Filesize

    1KB

    MD5

    760746c6bc18a85e7503567571fa6d8a

    SHA1

    0dfdce0bbc0c3aa4fa0507c40d4c14968fb28834

    SHA256

    a9db836bdbf007aa6b13cfb9ad280be457138db4464990356d682128c3d2a0be

    SHA512

    ff3f665660147120ba66bdbe472841a7f96daa81ca760c36c79cafa8216d5e8eb097f202ebfde5e0dc9ab761fb2ce72b3fb09aa854c872f9961e8f388f097ee7

    Download Submit

  • memory/1280-25320-0x0000000000A80000-0x0000000001090000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1280-25323-0x0000000000A80000-0x0000000001090000-memory.dmp

    Filesize

    6.1MB

    Download