Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 18:40

General

  • Target
    09dd6788f358f9135f9f66b0cdb51780_NeikiAnalytics.exe
  • Size 161KB
  • Sample240525-xbf6jsed43
  • SHA256 ad147b852dd5f2619cc44d7ff5e6c83e060764b502d341dab2e6dfe7d11b6798
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (5153) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09dd6788f358f9135f9f66b0cdb51780_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\09dd6788f358f9135f9f66b0cdb51780_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\_Examples.lnk.exe
      "_Examples.lnk.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3600
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:184

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
        • Size 79KB
        • SHA256 5cbacf408e834c38e44233eb495e62eb1d2d84321166e81bc3c0b8a26ba022c1
        • MD5 SHA1 SHA512 SSDEEP

        desktop.ini.tmp.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp.tmp
        • Size 161KB
        • SHA256 4a9dcfa25fe6f735a797d94fd310f7164c031245f20851dfe0950867dff6934c
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.chm.exe

        • Path C:\Program Files\7-Zip\7-zip.chm.exe
        • Size 192KB
        • SHA256 0ff6b75b4a08ebc7e1d78a636aadd3807587f1ae0384f68fcb2d9c4d462afd41
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.dll.exe

        • Path C:\Program Files\7-Zip\7-zip.dll.exe
        • Size 178KB
        • SHA256 24c6055ca4bbda21e3317e36b3f6ee5b7a6bd1f6edf35aff6224d6766502a237
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll.tmp

        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 1.8MB
        • SHA256 027997e16d2b474e49a67bcdfa6b093777a065dced50e6cb723ae7a11efd015d
        • MD5 SHA1 SHA512 SSDEEP

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 623KB
        • SHA256 67ffad9a592656cbe564a90a000c2ad3d7d3827cfaf5940b9e4aa62238b9f750
        • MD5 SHA1 SHA512 SSDEEP

        7zFM.exe.tmp

        • Path C:\Program Files\7-Zip\7zFM.exe.tmp
        • Size 1012KB
        • SHA256 a7ac436c184a664cb61a950d652eb2aa50d2ec1b513e2dc27b6742bb95d2efe1
        • MD5 SHA1 SHA512 SSDEEP

        7zG.exe.tmp

        • Path C:\Program Files\7-Zip\7zG.exe.tmp
        • Size 765KB
        • SHA256 ecd6e37e595825b91eb22e582886bb2fa9d052ccfc1f79668365f687e47ec445
        • MD5 SHA1 SHA512 SSDEEP

        af.txt.exe

        • Path C:\Program Files\7-Zip\Lang\af.txt.exe
        • Size 89KB
        • SHA256 d115efc3d0728956d6a3322aad26d9567f68171609684b2ae6c0d0ae297568a8
        • MD5 SHA1 SHA512 SSDEEP

        an.txt.exe

        • Path C:\Program Files\7-Zip\Lang\an.txt.exe
        • Size 87KB
        • SHA256 9112ce131bc54dd76f8bb46c958394f19d7a9397752a0b009ad06b584f4852e5
        • MD5 SHA1 SHA512 SSDEEP

        be.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\be.txt.tmp
        • Size 91KB
        • SHA256 f6719ba6bea793a699ebb2063dfc29f82c6e06f950f41b5bd09f6a17d834061d
        • MD5 SHA1 SHA512 SSDEEP

        bg.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bg.txt.tmp
        • Size 94KB
        • SHA256 b2ef0fe79e39d85e0bf11791f5528d04f6bdcdd62d0a5ce7c31b4efef84e058e
        • MD5 SHA1 SHA512 SSDEEP

        bn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bn.txt.tmp
        • Size 96KB
        • SHA256 e6b5232ac460efdb3a827f67f54c885215f919e24d2edeeff6092da4db376c7e
        • MD5 SHA1 SHA512 SSDEEP

        br.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\br.txt.tmp
        • Size 86KB
        • SHA256 130ccc7d96d9218a25e8fb5dc85ecbd52ff229e5a3f5c93b3dc34ede6c9c3ffe
        • MD5 SHA1 SHA512 SSDEEP

        cs.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cs.txt.tmp
        • Size 90KB
        • SHA256 55fc691e067ab3096ab62e6404b7f9c6f449464bd9c0a2558464c088c4c8da57
        • MD5 SHA1 SHA512 SSDEEP

        eo.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\eo.txt.tmp
        • Size 86KB
        • SHA256 e995364ec2c1f22384b4669fb4b02e12b17a66453de4775f5b11828c7f61db31
        • MD5 SHA1 SHA512 SSDEEP

        es.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\es.txt.tmp
        • Size 89KB
        • SHA256 6b7dfc825c6d00cc0ee8c23820ef8a392722c5880a63962e229abfff1450b06a
        • MD5 SHA1 SHA512 SSDEEP

        et.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\et.txt.tmp
        • Size 88KB
        • SHA256 c9a657a646c839fbe737f977090b55d9266668816be9a5a33045a0d465458ea3
        • MD5 SHA1 SHA512 SSDEEP

        eu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\eu.txt.tmp
        • Size 90KB
        • SHA256 b6dce598bb7fb708feabc6902269a6a7cbc5409a491f4bd8ba9cb47a9178131e
        • MD5 SHA1 SHA512 SSDEEP

        ext.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ext.txt.tmp
        • Size 89KB
        • SHA256 6b0102010359286a06e59057575950e0aea0083a4f64cffab56b06bebd6a0108
        • MD5 SHA1 SHA512 SSDEEP

        fa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fa.txt.tmp
        • Size 95KB
        • SHA256 b375c1dcce47453f56a287d18e23e72b89f3ebf922da4d2472ced8ce807a65a1
        • MD5 SHA1 SHA512 SSDEEP

        fur.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fur.txt.tmp
        • Size 89KB
        • SHA256 99e2960121b9eb54cf0185095061906965dc8ecf19a0f30e549a4e9cf958d876
        • MD5 SHA1 SHA512 SSDEEP

        gl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\gl.txt.tmp
        • Size 91KB
        • SHA256 804d789a6880a9e142e418f04c184fe08d5011fc2ae9e3ea7d168a24485eeab2
        • MD5 SHA1 SHA512 SSDEEP

        he.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\he.txt.tmp
        • Size 92KB
        • SHA256 e07fab071309aba8d1042dfad838fb59be1f21e920338fa59391a99d774f16de
        • MD5 SHA1 SHA512 SSDEEP

        hr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hr.txt.tmp
        • Size 90KB
        • SHA256 5cd63dba3da5308b8b27a69f4533c649870125044d2cadee2231ea821f2c931a
        • MD5 SHA1 SHA512 SSDEEP

        hy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hy.txt.tmp
        • Size 95KB
        • SHA256 0de55262f25e2bd43c7465a2a291508ca17f2fbc97a1dcc09fbddfc35f76001b
        • MD5 SHA1 SHA512 SSDEEP

        id.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\id.txt.tmp
        • Size 90KB
        • SHA256 ce11889ed884062d1e46023f297a897309641d1a91b31a468423149931fc0e6d
        • MD5 SHA1 SHA512 SSDEEP

        is.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\is.txt.tmp
        • Size 88KB
        • SHA256 5ac7870734cf3ded6641cc263f5e1b138a12e7b9b61158eb879ae299144e7d4f
        • MD5 SHA1 SHA512 SSDEEP

        it.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\it.txt.tmp
        • Size 89KB
        • SHA256 3643ade150a00f57e76981abe2fb5def607959875fd044e431591f83388dff93
        • MD5 SHA1 SHA512 SSDEEP

        ka.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ka.txt.tmp
        • Size 99KB
        • SHA256 4d3cd9d0389beefbf8af35e5f9f514e415ab184696b3af3bd52067613153c3bd
        • MD5 SHA1 SHA512 SSDEEP

        kab.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kab.txt.tmp
        • Size 16KB
        • SHA256 18c1a5841909a325ef24b049b01a9bea0d3ae7e43dc32937bb6c9f994e7b49bb
        • MD5 SHA1 SHA512 SSDEEP

        kk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kk.txt.tmp
        • Size 92KB
        • SHA256 2152783714733272a1901286bd78ec56cdea6297c0ee9f1b1fe85fd5cca45f8e
        • MD5 SHA1 SHA512 SSDEEP

        ku-ckb.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp
        • Size 93KB
        • SHA256 9783647364fe0ba39e2751e87b6522fe1778d71d85190c20d90cd978f9da9423
        • MD5 SHA1 SHA512 SSDEEP

        ku.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku.txt.tmp
        • Size 87KB
        • SHA256 f13f97e063fa9099daf07198a308a7d477c0eadba20e5cae3c12371f508c01e6
        • MD5 SHA1 SHA512 SSDEEP

        ky.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ky.txt.tmp
        • Size 93KB
        • SHA256 ac0d33e3b81b31dc5dbfca7852d49b4998aef43af389231dfc8fa8a9b61490b0
        • MD5 SHA1 SHA512 SSDEEP

        mk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mk.txt.tmp
        • Size 88KB
        • SHA256 7c30b4db7d801e71774397ac6f3bbddf990268b86fc743cf83dfd7020b82bd34
        • MD5 SHA1 SHA512 SSDEEP

        mn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mn.txt.tmp
        • Size 87KB
        • SHA256 074eccd2238d80392c9d136c0ad7f04672960e2ea703e90a283c46a8d779d1b0
        • MD5 SHA1 SHA512 SSDEEP

        mng2.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mng2.txt.tmp
        • Size 102KB
        • SHA256 61d7ece467ccac90a96798831aa15cd27e748a00a5158e783e6adf762521ee60
        • MD5 SHA1 SHA512 SSDEEP

        mr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mr.txt.tmp
        • Size 92KB
        • SHA256 c9025062795004e7e024c1b75167e2068c4d12e5be3b5724fd6de0bb671be976
        • MD5 SHA1 SHA512 SSDEEP

        ms.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ms.txt.tmp
        • Size 86KB
        • SHA256 dd58fb9b9608ee5afb7eeba1b68a6c3fd9f4b0a4b8a34acab0935915b063f7a9
        • MD5 SHA1 SHA512 SSDEEP

        pl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pl.txt.tmp
        • Size 79KB
        • SHA256 6b35bbb1eafd8af4031a20817e57d39eecb2368a99972bc9fe6f8e9746cc64b7
        • MD5 SHA1 SHA512 SSDEEP

        pt.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pt.txt.tmp
        • Size 91KB
        • SHA256 a29d3d8b36efb23bcf1f2c5abb41ac57d8846f5b038dee3f35f1d9e29eec51b2
        • MD5 SHA1 SHA512 SSDEEP

        ro.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ro.txt.tmp
        • Size 89KB
        • SHA256 d145081e5de119017a9424c7683e601767c2bd15b554cb595bb06ef932d07deb
        • MD5 SHA1 SHA512 SSDEEP

        ru.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ru.txt.tmp
        • Size 79KB
        • SHA256 cc1272e6e226f6fbaf60af8ac230e798386df4e36f69cf23cd9bb2bb8c20287c
        • MD5 SHA1 SHA512 SSDEEP

        sa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sa.txt.tmp
        • Size 100KB
        • SHA256 60e36ab6d884f657820f1c99a7b99faa0c3f395e2065bd55cec0c013e6b2767e
        • MD5 SHA1 SHA512 SSDEEP

        si.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\si.txt.tmp
        • Size 100KB
        • SHA256 92c508f43553320c128d93ed19ab53c7f719a1953ac68db7b4362292ca6a86d9
        • MD5 SHA1 SHA512 SSDEEP

        sq.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sq.txt.tmp
        • Size 87KB
        • SHA256 8ea4708c6d5a8f3d9355bb57b4a7b7c6332ec13de32e6d72dbfccbc55756e014
        • MD5 SHA1 SHA512 SSDEEP

        sr-spl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp
        • Size 88KB
        • SHA256 ca6b2d535d11bb6431f94029ec4c61732d7e95795439b6540fa8b60d4698caa3
        • MD5 SHA1 SHA512 SSDEEP

        sw.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sw.txt.tmp
        • Size 90KB
        • SHA256 6207459b90fb2aa857139d424b9be935f0eccc69c53adfa8e8022d9c59e17342
        • MD5 SHA1 SHA512 SSDEEP

        ta.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ta.txt.tmp
        • Size 93KB
        • SHA256 cb5cd10ceb9b9214beadc4c6990f38105ed888a68a36b4d01766001bd2694688
        • MD5 SHA1 SHA512 SSDEEP

        tg.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\tg.txt.tmp
        • Size 96KB
        • SHA256 d3dd842514d0bd6e814e64a38229a22e04087bb962c6269758914ccb386a9f6e
        • MD5 SHA1 SHA512 SSDEEP

        tk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\tk.txt.tmp
        • Size 90KB
        • SHA256 b5f3eb313f416014d1f5582a18059aaaf186d0389956c4c2e55beb59267135f5
        • MD5 SHA1 SHA512 SSDEEP

        tr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\tr.txt.tmp
        • Size 89KB
        • SHA256 4925c3d8ba7358890bdbf235e5df3e700320c5a970daf497a60ee6ddb7284de2
        • MD5 SHA1 SHA512 SSDEEP

        tr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\tr.txt.tmp
        • Size 89KB
        • SHA256 9e36c3482bf2089d4ddb4f13084edd94e617e261a27c67cf76d4f53c64df6015
        • MD5 SHA1 SHA512 SSDEEP

        mesa3d.md.tmp

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp
        • Size 87KB
        • SHA256 187f974fe49fa100b024717ae4288610a4cea0eb42d643e32226580d6dba7bf6
        • MD5 SHA1 SHA512 SSDEEP

        _Examples.lnk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\_Examples.lnk.exe
        • Size 81KB
        • SHA256 7be9bf1f5f2346fa1682906a719be1e2b90280b7ba2d5b7338c7051adf245251
        • MD5 SHA1 SHA512 SSDEEP

        Zombie.exe

        • Path C:\Windows\SysWOW64\Zombie.exe
        • Size 79KB
        • SHA256 b40b22bd7b3f4f50c3bc65c71fbd98ecd73761902ae5d97e4a83c3d3856cb0f5
        • MD5 SHA1 SHA512 SSDEEP