24aecb71d9d0fcc029264fd5638011b90325a1db9214e616552cdb713bf83aa1

General

Target

e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe
Size

225KB
MD5

e691aef25308f0bcd4ace49c2a920c30
SHA1

1c06f6556b36b9dbefb787c601d27fa2730a7e3f
SHA256

24aecb71d9d0fcc029264fd5638011b90325a1db9214e616552cdb713bf83aa1
SHA512

36bf77710a098bf6a8c414f7df7d32e7808aa2cdf33b8668084b6150dbe78a13a3ced806bdc8c963c904cf5118e55f50c6ffa92ea0cea7b636e22fa03f79c8ff
SSDEEP

6144:RqKvb0CYJ973e+eKZ0V5O9xpKbShcHUan:vvbxYX7Z0VbvUan

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5014) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_cuninst.exe

pid process

1584 Zombie.exe
4128 _cuninst.exe

pid	process
1584	Zombie.exe
4128	_cuninst.exe

Drops file in System32 directory 2 IoCs

Processes:

e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	Zombie.exe
File created	C:\Program Files\ImportConnect.dot.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe

description	pid	process	target process
PID 2676 wrote to memory of 1584	2676	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe	Zombie.exe
PID 2676 wrote to memory of 1584	2676	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe	Zombie.exe
PID 2676 wrote to memory of 1584	2676	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe	Zombie.exe
PID 2676 wrote to memory of 4128	2676	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe	_cuninst.exe
PID 2676 wrote to memory of 4128	2676	e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe	_cuninst.exe

C:\Users\Admin\AppData\Local\Temp\e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e691aef25308f0bcd4ace49c2a920c30_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2676

C:\Users\Admin\AppData\Local\Temp\_cuninst.exe
"_cuninst.exe"
2⤵
- Executes dropped EXE
PID:4128

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe
Filesize
82KB

MD5
dab6a9b645c78346a999c529df40e81b

SHA1
17d3db109e99d29c06da5ddb19ce80a13bac6eee

SHA256
e478efb7891d04e78f36b356dfbd62e94c9fbb1f61b12af91936b54344bbac8e

SHA512
f80295c2b28ad85b45eb46377c19f4c5c84a6f3d82df1ed7d12f088cd7d0b0c375491c94e901f0a128413908f9023008178c9e2b7e841fec5528c9a03ac50116

Download Submit
C:\Users\Admin\AppData\Local\Temp\_cuninst.exe
Filesize
143KB

MD5
7f9f981d970cbccece6ff126ab309045

SHA1
950a14dc6b636237c2f158cce02076b1a1b371e0

SHA256
82596d7d86d685087965457c297973c2aa1fbff0f6a0a3b8d8760f1cc65105cf

SHA512
ac59a2c6bc3b6fad47bac83d84336387b03b45d186c5d021f3c57c7fb160491e8344923d4978e50fb37f6c37e45bbb9c0f9b7cd4b93506ff571c82b795c6fb47

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
82KB

MD5
91c73dd48b5f3b73d3eda72ab4b78596

SHA1
2d062b73c13f58ec63faf2c7445c38cb61f242e0

SHA256
83cf0fb8eea30f2d5d422559b76bf677ee6b8c19b60f8125f9c46d8d0525434f

SHA512
13d139acc4d12ed1ad1bd8033222556454363fb824d4302775c3ccae5e2388c73cf11f04c69cfc2bf66b80d3b92fcd8a98a365f002e16db210b579272e9454e4

Download Submit
memory/4128-20-0x00007FFF7CB13000-0x00007FFF7CB15000-memory.dmp

Filesize
8KB

Download
memory/4128-19-0x0000000000F50000-0x0000000000F78000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads