Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 02:15

General

  • Target

    82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe

  • Size

    54KB

  • MD5

    82d931fba7d3010680d070e1cf0e7650

  • SHA1

    4759e0df57792c6c03294d9a5102eba498b41f44

  • SHA256

    e3a5bcf409210125ff08c08fccf665980b3c6a939a117805b03f6f7f3c465ec6

  • SHA512

    330fd83d50f28bf960ba65f85d9e3668c44d438e4e705f21a4b687f0e294d00693c73664745b98b7ec17ad9c4d69f8bc6288aedf4ff6a005a39ce3b0e936d152

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97nF:KQSohsUsxe+erZF

Score
9/10

Malware Config

Signatures

  • Renames multiple (2068) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2548
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3020 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1780

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

            Filesize

            54KB

            MD5

            d2c002596875e8f332b4bafebfa1465e

            SHA1

            a86cfeb95a89c4ea3bf7b09b5e8ab76938599afd

            SHA256

            30aef91eee37f39941d31d1ea8d350889b86ebc19b0a8c3a0cfe3aec06203987

            SHA512

            da0eaf69ee34a056044ab3b0015842fbf48e067271c4119b5f160871df1b3cb35d31e55f20809ac1237da5c385df45c8534bd9d76cb5d698890c6323e56dc71e

          • C:\libsmartscreen.dll.tmp

            Filesize

            54KB

            MD5

            ae8395607c4fab903b407d76e149eb09

            SHA1

            df697e7c82979876e0dac3b2b0cc0bbae298ad9c

            SHA256

            04f034995e36a0a51aee5c5e91d2f3ac25b93a238a124b5cb404d0bc423ca78c

            SHA512

            0d0e8e60218e6ee28e6a5e334818701c5d5dd19662470948617f561f82d478d3926a1f70b4bb694ac6cd9d6ddf48d5ae4e31ff8abfa34bb6d505759afd1def5f

          • memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

          • memory/2548-322-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB