823a08d92b83a3e4d10f3c777c0072d5e239aecb7561af8d226316e176fe75c5

General

Target

e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe
Size

402KB
MD5

e5e5e7125c0ed4071386a5eeb81e0e30
SHA1

58280c768ef121f532375e96f90c12d478f28777
SHA256

823a08d92b83a3e4d10f3c777c0072d5e239aecb7561af8d226316e176fe75c5
SHA512

f756622070aa39eaf20c4152a26466907fbf94202ee027847e0d94d4f982d474f547cb6c282ceef74dab75a1e86aa93c4f70b568787c6aaaad897807135151b4
SSDEEP

6144:RqKvb0CYJ973e+eKZ65lqo52kDzMYDJSi7+Ni2ER9Vh98+1PrEVhkQf0huIDaLOD:vvbxYX7Z6MqzBDJkk2ERvT8MPAf/O60

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4860) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_7z.exe

pid process

1288 Zombie.exe
2064 _7z.exe

pid	process
1288	Zombie.exe
2064	_7z.exe

Drops file in System32 directory 2 IoCs

Processes:

e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe

description	pid	process	target process
PID 4784 wrote to memory of 1288	4784	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe	Zombie.exe
PID 4784 wrote to memory of 1288	4784	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe	Zombie.exe
PID 4784 wrote to memory of 1288	4784	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe	Zombie.exe
PID 4784 wrote to memory of 2064	4784	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe	_7z.exe
PID 4784 wrote to memory of 2064	4784	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe	_7z.exe
PID 4784 wrote to memory of 2064	4784	e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe	_7z.exe

C:\Users\Admin\AppData\Local\Temp\e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e5e5e7125c0ed4071386a5eeb81e0e30_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4784

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1288

C:\Users\Admin\AppData\Local\Temp\_7z.exe
"_7z.exe"
2⤵
- Executes dropped EXE
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe
Filesize
78KB

MD5
a1562e56dd97db41b2163aed33de290f

SHA1
9839ca3cf384bd8a0b34bdc74cfbdf73e1ce4b5b

SHA256
7db24acd775cad14bfdc5fab44de56a6d2f31c6615dbabe3f45f435599fd6f31

SHA512
5e0320ff13274c58db58a44beffa6e31bb6c056a80f38a25353e029dda2b800d98ba3547ccbffa9c418cd6168d6d687e12957958c01b1681bc47886a0477b1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_7z.exe
Filesize
324KB

MD5
7187ae605f4dce14bb23ea2623956335

SHA1
f7c1df33b875c98f41dcde24117d89d42d25b7ce

SHA256
9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e

SHA512
f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
78KB

MD5
5f6f29e29bc5f285d2d6c30cca909155

SHA1
c5d91a27fb4784755a1edb41fbc6e1a8fdc8c10d

SHA256
32552483635bc7cadb682a84e921283c845bb1e7accde9ec40477319dacc9601

SHA512
6016d8292353f5e98d499ba3bfc5d9815eeae8e4c24c88f4e80c775aa0b83d0109c75d8e7220e15d9ad6566897176a8e3969e9502fa921acba56131a005b7a50

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads