f0e4f509c77f253943d745cb366ab0db81893ddddc1e825e9577251e57928d1f

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe
Size 223KB
Sample240530-e5pqnsef6z
SHA256 f0e4f509c77f253943d745cb366ab0db81893ddddc1e825e9577251e57928d1f
MD5 64a5893cc3cc9e658755b771c05b4310
SHA1 7597c79434b73ebc518c665c710b267dadbc9c8f
SHA512 21b1243b3671e88459c7445d6ca1bb9754634fdbeef0797cc7e6b01024476bd3c0448e079f6c3604b6c50b0ee2137105d7f9074ef10875d0d472f61eacd77e20
SSDEEP 3072:69WpQE0zTE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Exh:nL95pK7ShcHUaG
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1556	Zombie.exe
4020	_clist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1556	2376	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe	90
PID 2376 wrote to memory of 1556	2376	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe	90
PID 2376 wrote to memory of 1556	2376	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe	90
PID 2376 wrote to memory of 4020	2376	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe	91
PID 2376 wrote to memory of 4020	2376	64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\64a5893cc3cc9e658755b771c05b4310_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\_clist.exe
  "_clist.exe"
  2⤵
  - Executes dropped EXE
  PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4456,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
1⤵
PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe
Size 80KB
SHA256 0a381377b77f9494e2280b9f605218fffa7da956cba4c427910cab14041b1c2f
MD5 732f0d4b22460fbd5d8962a9d4887980
SHA1 485e2004029a6bcfa90edbb33d6ffcc7e7379d19
SHA512 b9711713cfff24e0a8282df0880e637504124bc42a0fb7c078229ce67ca5f05cf20d5939cafe96ff7888ada62efce9370a09f2ff36d727fa89958594ec1bd4d9
SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKE:69WpQE0zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_clist.exe

Path C:\Users\Admin\AppData\Local\Temp\_clist.exe
Size 143KB
SHA256 fb7fab836f744d669451dcd38aa7d2a9c74c6af893c258d079439b58abce70d8
MD5 b27ea830fb39bc056e65f9a2260ae216
SHA1 b69e40ee5cabe0721d2d1e9fbdd4088fd87592d6
SHA512 22cad79d90a949174828ee5e3ce621113591c7c991c55c1a6a44a4555002adeb3bcbd9bab6cfbbfdefd663b76ac2dae96d70a01c527b312c7e8d223334a30219
SSDEEP 3072:WE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2ExX:J95pK7ShcHUac
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zombie.exe

Path C:\Windows\SysWOW64\Zombie.exe
Size 80KB
SHA256 754e30f819f1fcb5061d0ab3c35fb29cc13f8f577f6b75d9f003fda7d779ae5d
MD5 ba72c7a5adeaa51dc3f5d70edc6dad39
SHA1 dd885345cc8d641aa4befbf40a507e47bb6d0af2
SHA512 153bfbe48f3404f10f10f865dad60dc7096d06ceac1b8f941765311e8ff380ce89b560b45b685279994e84b78b73c68ba9549b58011df61c40d60563990e3bfd
SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKt:69WpQE0zI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4020-21-0x00007FFF006D3000-0x00007FFF006D5000-memory.dmp

Download

memory/4020-22-0x0000000000490000-0x00000000004B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads