Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 00:07 UTC

General

  • Target

    1c36e727c25395afe3a5a2d7d1f6ab30_NeikiAnalytics.exe

  • Size

    74KB

  • MD5

    1c36e727c25395afe3a5a2d7d1f6ab30

  • SHA1

    cf89bea4a123fbc0920373d37d22cf914c6c8788

  • SHA256

    6c525e4595f6fdd1152b497a2fbd4948bcfea5f4743b80f20a546c5376bc69d8

  • SHA512

    eb27002bc257fd3afe04e0077a28bec8a3b99ae2277c18c5e7a3b892814db8004be85b084aa40e70a68ea0becdd841ea63a385d68dd8fc1b8b3ef27f1aaa0227

  • SSDEEP

    1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsWfnf0fB:+nyiQSohsUsWfnf0fB

Score
9/10

Malware Config

Signatures

  • Renames multiple (3474) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c36e727c25395afe3a5a2d7d1f6ab30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1c36e727c25395afe3a5a2d7d1f6ab30_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    75KB

    MD5

    7e1cb7b0e635eed561a603826c2f3932

    SHA1

    253b90113c6fc4125743e0d49d0360fb22a7d300

    SHA256

    770690c67815653a20a2db1d003e930b8c6a78126706331cb95860fd86da7cb0

    SHA512

    7a161b155e3943818449acb3804f6e7308a32d8cac41be0072cd4bf8979bcd41e6111e61fb8280aaaf667ab38d85585a3979b44a0778a4bec3456e859df2b866

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    84KB

    MD5

    456b7499e8bbcbd4a75f3cf77ec59e26

    SHA1

    9f0a9ecc387bbc145b305b2d32731b8e5fddd010

    SHA256

    001d02e57adc2de9bf9b46132637a929f3f3693982f5a01f6d6e04a0cfe6d21b

    SHA512

    11a87e518f267b3a64d9a365df3fa9ec7666d7f4708eb3fea8bb2880053b0cb880caca9eb06f0b7855f807e1ac952d29984af57e22deba3137bf08679557cf3d

  • memory/2100-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2100-650-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.