Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:39
Behavioral task
behavioral1
Sample
a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe
-
Size
206KB
-
MD5
a0681e79a7b3192f0e1095bd50230090
-
SHA1
ede4c71e7d34095115d8f146f4767be8f53105db
-
SHA256
7769de9fedf458d1d16fd04b5f5f74216a904fdb7b48fe032b34aa40b0bde2aa
-
SHA512
5711474900a0a7ca704cebb667c2f113b9622108e59f3f97740e218b26f9daf6c26749e1ff3aebb6ae0a8a2642ec9a32b1c932fd9a5676f77ce921c95c23ab23
-
SSDEEP
3072:fnyiQSowI9KHpKHDGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2lxGN:KiQSo/9QpKjShcHUaC
Malware Config
Signatures
-
Renames multiple (539) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2996 _cpush.exe 2864 Zombie.exe -
Loads dropped DLL 3 IoCs
pid Process 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2956-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000015a2d-5.dat upx behavioral1/memory/2864-16-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000015c87-19.dat upx behavioral1/memory/2956-24-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp Zombie.exe File created C:\Program Files\AssertPublish.odp.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp Zombie.exe File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp Zombie.exe File created C:\Program Files\Internet Explorer\F12.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp Zombie.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2996 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 29 PID 2956 wrote to memory of 2996 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 29 PID 2956 wrote to memory of 2996 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 29 PID 2956 wrote to memory of 2996 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 29 PID 2956 wrote to memory of 2864 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 28 PID 2956 wrote to memory of 2864 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 28 PID 2956 wrote to memory of 2864 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 28 PID 2956 wrote to memory of 2864 2956 a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0681e79a7b3192f0e1095bd50230090_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\_cpush.exe"_cpush.exe"2⤵
- Executes dropped EXE
PID:2996
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5aab9a2a80f4efb8f67f09db9b10d749c
SHA1dfd427cbeec89ee4d32e31359b73388fd17c5cc0
SHA25658f7bef23a3949d6a50bc992d05f5d155b5aa681ccad5a8d8379da2602e73571
SHA5124fdd5068f382e1c271c9af632194e36c1fc8272867091800f95eea4c616a01c3fb4ac94ea1ac811d71a7d9f83c8a454ad0598909b09adb996238aeb346e0abca
-
Filesize
143KB
MD5c1d5e48111f4984433e6318466ee1bce
SHA1d3379a99f504b38794f491e4fff6c77cfab53eac
SHA256dfdf187874d7368a92bbebb68c8cdc5c183af47d954b5b27ddaeca6774ae4822
SHA512dfce97a9dc92521c2d576b3d21071cb04df4a6d927676a2b95abc0093b67a044aab8d3f8612a4a70f9128cf2555d3a554a1c3f941647a64d30298ab28bba7441
-
Filesize
62KB
MD5a5132d3a3f17bfd6fa64f5b30272e058
SHA14762186fe00e4e136f23cdbc9c8c855558a5084d
SHA256991038af0a4742dfd53a8f6649369598e4c966a10f0cb83baf3ef540b93d0bc9
SHA51247d47a8058eff2029ead977f48a928ad3a00d6959406e439ddedb04a800aa5af59fbc593f6b52992cf106cbf79030d616bbd4c79eafbb549f59c418048c68e08