Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:22
Static task
static1
Behavioral task
behavioral1
Sample
1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe
-
Size
396KB
-
MD5
1efe27e85891a46a1e7959c12fd137b0
-
SHA1
cb2a2fe051231b335393982e85ebed4e37f27a3b
-
SHA256
19c7b6bbf6dca55efbe542bd69260269a5c1afbb4b93b70dface6145c485fb19
-
SHA512
6be1392d7126a6997314db44d7d1df60a2a0aa7a50140ae7c4363feff8c9fca1fa6bc8057f3d9e1fcba5b83504eb79dc55aa912b6db946bd44b6da5a585f8d1f
-
SSDEEP
6144:RqAtkemFTlAOB6pcq+HpFeHPgsHsSYafq8g2Oo:dkhAzpcqapMvgzS/Jl
Malware Config
Signatures
-
Renames multiple (3505) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1712 Zombie.exe 2368 _ConfigSecurityPolicy.exe -
Loads dropped DLL 2 IoCs
pid Process 1244 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe 1244 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp Zombie.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp Zombie.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll.tmp Zombie.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp Zombie.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\highDpiImageSwap.js.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\currency.js.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\jdwp.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1244 wrote to memory of 1712 1244 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe 28 PID 1244 wrote to memory of 1712 1244 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe 28 PID 1244 wrote to memory of 1712 1244 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe 28 PID 1244 wrote to memory of 1712 1244 1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1efe27e85891a46a1e7959c12fd137b0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\_ConfigSecurityPolicy.exe"_ConfigSecurityPolicy.exe"2⤵
- Executes dropped EXE
PID:2368
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5bb281d1b23e57c7bcd2bf4429eb6230a
SHA13252fdf655843f1911be49e2507cc3634685e805
SHA2566dc6bc5b2ce78befd9149c5ffa1e3bd4b35603931cc129375d97cfe7038ca51e
SHA512c84fbb7e787d2f558bd874b273d72361ffa5b66587a635560d72adb9201a5137ba641a5ecf3cfcee50a7114c322be8aba17c9fd5dd236eb1407f44d2e226f00f
-
Filesize
304KB
MD5a2ff144973a98d241d129081fa9baa6b
SHA17db942775d84fe782e85390c0ddd1b1ef61617b1
SHA2561cc8e44c620067448bdd2fa88f9ff3a3c64b9a3f06b51c4116ab73376a48bc0a
SHA512c71abb7c0ad554d5f1a5e324163763c6ff5476d37145092c69f213973278c7899818a3809a80323184eaedcbd45f9f5a6acd73d776dc617d32ededc89f84a303
-
Filesize
92KB
MD50ee6b6de6a5dfda15635bf72507964e9
SHA15c2266fe332d7fee86d02041482310adee86fb9c
SHA2565a2dc4a2e4bddde80baf9143b58a06779134bb03a693449523f92e3867766e0a
SHA512c60b923b00a3f843ee4a514d0ff0549a68bdd14d71e3d214b923a15a13b6f945024368a29cf14ac2368189548325ae6f10ab8f7bb870cb00065ee91e524d0411