Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 23:15

General

  • Target

    1ed9d7e599d05943316e6cd79c1063c0_NeikiAnalytics.exe

  • Size

    140KB

  • MD5

    1ed9d7e599d05943316e6cd79c1063c0

  • SHA1

    173a4d4ec267acde63e73f18b3b22c3db701a687

  • SHA256

    a544de4f8fb7ea202ea841f06309c9cce87560db1decc0ab16815c93ea67bb3d

  • SHA512

    45b77a32e63daa10ccc6d6a5b6cdc3c774a282df1a56aef39c08fe1f4289af3fe16d7760a29f2f3b6fc6b8d1bba4fe28d67d595a044f3247f66b8285e3e7129b

  • SSDEEP

    1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCT:fnymCAIuZAIuYSMjoqtMHfhflixiq

Score
9/10

Malware Config

Signatures

  • Renames multiple (4750) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ed9d7e599d05943316e6cd79c1063c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1ed9d7e599d05943316e6cd79c1063c0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

    Filesize

    140KB

    MD5

    3c0e56b821d6407ae5499c39d16e0dd4

    SHA1

    1400729407678bb434dbca9f2eaadaeccaaa7cb7

    SHA256

    481ba1b4bca91344eeb4de9f6f66bf322c559f051a50d2676d20072d49958ef3

    SHA512

    a4da0dab0ed467b68fa438173a5b90ba99d0829e88d0c878bbdd64d71462523832663fc305c3bcca66f00f3e583b4d32d4eba0903fed59b74d328710de698725

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    239KB

    MD5

    72a3cccde44e60419bca2d0be47b298e

    SHA1

    437619f8e2fc4f15f6ff6419b514d1192fe6de2c

    SHA256

    d1dfd43060648d43b3ada00c0fb8a560fe27d60f505b3c2b95a428a47421a0ea

    SHA512

    abd0766e4331b4c7db4b4aebcc63d43cc92bba7d57a83465a85f5fbcfb084c1b225969eb4a0244c2033da9389a5848dc6651a71e37fd668e8622e0eaca29dbd9

  • memory/4448-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4448-1726-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB