Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 15:13

General

  • Target

    a98d918e4b175e1b94c093741da21e10_NeikiAnalytics.exe

  • Size

    65KB

  • MD5

    a98d918e4b175e1b94c093741da21e10

  • SHA1

    30318cb908487b0fbd69b31526c765380c65639f

  • SHA256

    5e7a9028cbcf17d359b081ae891cbbd12aa70a29c1f472b082353e7967823337

  • SHA512

    0b6009a202120c32a1ce95fb65f79253bd982993c1f58574482598d2957a4ad3c1bafe7957fdb5f8387172556c68a7ebf3cd528723ca9f8afe3ae5d17d6795c3

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8J:fnyiQSo2

Score
9/10

Malware Config

Signatures

  • Renames multiple (5197) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a98d918e4b175e1b94c093741da21e10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a98d918e4b175e1b94c093741da21e10_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

    Filesize

    65KB

    MD5

    e79eef87b0a2a43d945340f0465ecd9c

    SHA1

    db520999e104de401fd3874acc14f9f803055831

    SHA256

    be3338b9a652e84a6ae3460858a7929a59fcc2ee12fdfbea28ce6b504e9d5c2d

    SHA512

    eb4aab4b31d2d44988e43b81fd73d4bd59e00cdf48e9754063d9636caa7154266174f91d44276efe2edb4ba69188e57d191eca5c667ef2f31e6d7582588df634

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    164KB

    MD5

    15033376193a5e5c682bb0a2654d2ba6

    SHA1

    58aa977d95350d8c98fa780b6fa64add8a1cd7bd

    SHA256

    c58d0b3e4ab4b2b69bea764c7f268f66e7b66889e2e430419b8920c5fa3e1628

    SHA512

    b63c11687705fa75fe454e5afe1619744ffce45cbb159e25ec55498e29f4d02e765be8280405dedb64a1da80aa31fb5cefbadd08a49944b1aff3deb6ae464f7f

  • memory/3156-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3156-1894-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB