Analysis
- max time kernel
150s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe
- Size 217KB
- Sample240607-a4tk1sef4y
- SHA256 b2028a1ead446ed5fc3f6498039c4b6fe40b9cdcd68f89c4fdd5e964942e5a72
- MD5 29c9aabfae676f05e20d7c91e8ef4200
- SHA1 d0fd32d2564934dcd8545118cbf104d8a8e24f63
- SHA512 723c4b3ac0469213bc22bf1e1bac65f71f138f59514d2134874382954636417a2033546890fbaf20baf9dd129d72e6086f7f6cc72d1ec26346178dd2d1048d53
- SSDEEP 3072:6pWpzw9J3NWjGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2K:PG9RNgShcHUaK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2876 Zombie.exe 3824 _cinst.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Zombie.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp Zombie.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\Welcome.html.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp Zombie.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2876 2500 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe 83 PID 2500 wrote to memory of 2876 2500 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe 83 PID 2500 wrote to memory of 2876 2500 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe 83 PID 2500 wrote to memory of 3824 2500 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe 84 PID 2500 wrote to memory of 3824 2500 29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\29c9aabfae676f05e20d7c91e8ef4200_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\_cinst.exe"_cinst.exe"2⤵
- Executes dropped EXE
PID:3824
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 77KB
- SHA256 a261161192abdf3a69694d608b320e065c4dc45ea2db53429b3d11477aaf36cc
- MD5 fc43675fb36936faf64b3bebf30d21a0
- SHA1 105cb045959aad80817c22691724add62b6b785d
- SHA512 c563d9b07a054180462950895f8bdeae75a05474e29db9151b3937dffac8a9b23428a1acea89b6e8f7867a71fec8f35b2dcaed3c0e9376075541476090385b7c
- SSDEEP 192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7GliGY61Y62:GBt7Br5xjL9AgA71FbhvoBlLLU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_cinst.exe
- Size 140KB
- SHA256 78d2e178e31c83d461034311ae3f12dfd25bcef67c43e0afcd08250dd5aa90fe
- MD5 076b54b5c315c31a68e4823b227cab12
- SHA1 454ace190aabc45f417163309ffe332677b5b58d
- SHA512 2b6976626ab5ba9bd2343c5d2f74bfc7f889785de02a7a30f3b57cd515d437e9b553bfdd5d20c14dd71810c69489775be446b9adab149134508990582584cdb6
- SSDEEP 3072:cw9J3NWjGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2l:X9RNgShcHUal
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 77KB
- SHA256 92b5eca4a3004e168863f6b87aec9195a9c9c83e8d36cb461e9ac97356a07b75
- MD5 f1923d2f7256103d4848c6b7878d966e
- SHA1 2d3fa3a79c3f6dc6e40c398f7f8b41d99a7e6acc
- SHA512 10ed4bdafd75cf296fca0be8c43c2298c6fadd3c4669fab0ad04db79f0caa44d90f62e656c2773be011f6c2f6b24906afe1107847bd522c61c76f12e9fa55a98
- SSDEEP 192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7GliGY61Y6I:GBt7Br5xjL9AgA71FbhvoBlLLW
- MD5 SHA1 SHA512 SSDEEP