Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 23:15

General

  • Target

    1ed9d7e599d05943316e6cd79c1063c0_NeikiAnalytics.exe

  • Size

    140KB

  • MD5

    1ed9d7e599d05943316e6cd79c1063c0

  • SHA1

    173a4d4ec267acde63e73f18b3b22c3db701a687

  • SHA256

    a544de4f8fb7ea202ea841f06309c9cce87560db1decc0ab16815c93ea67bb3d

  • SHA512

    45b77a32e63daa10ccc6d6a5b6cdc3c774a282df1a56aef39c08fe1f4289af3fe16d7760a29f2f3b6fc6b8d1bba4fe28d67d595a044f3247f66b8285e3e7129b

  • SSDEEP

    1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCT:fnymCAIuZAIuYSMjoqtMHfhflixiq

Score
9/10

Malware Config

Signatures

  • Renames multiple (3427) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ed9d7e599d05943316e6cd79c1063c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed9d7e599d05943316e6cd79c1063c0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    140KB

    MD5

    f94a6d4b0ea8411240ff1f364371a0ff

    SHA1

    13d2618c45d040e4e6a0011afb8582e42e0e85c0

    SHA256

    1d2040a25576241c0b1358079b98f1396a84380a81f04f0870e8c288276c2831

    SHA512

    4eb22e3b6f6c427c9181591782f608d0559f915815a0d4b84876a030ea468f1eea503b44ae1519478538b91122cda32cc497814555764913ea67c3ff9db9cc3a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    149KB

    MD5

    346a0a8129fbffd3d0c4ef6376d96504

    SHA1

    5fca30436b8d5c43071a132139198186584866df

    SHA256

    3d6eb96548f659d52e91f525b5f2aaa6d5519e3d1c8b8d0532815169afa9e89b

    SHA512

    7c4ad220db41ae292f8ddeda1f0d5043b29316d74de715440b0954e2a5c6c15b66c9af5f9d1f303fa5e94c60820114630602a006ddb6eb4811776716519c8f1e

  • memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2220-642-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB