Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 23:54

General

  • Target

    1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe

  • Size

    52KB

  • MD5

    1fd5cebb0c73b868003f5ae651bd3b30

  • SHA1

    746629db4ea0d8b1e45423a1abceeb95665abf93

  • SHA256

    73a6b25ce551a41566aad6d36f3ace12ccf46f18ca109762f4796cba125039b8

  • SHA512

    6ee65044bdba27350a728907f7dd8c66a7a7dd868758c787aa7a6a48fff8cffe9fa83fda202241f78b592c171aed161f0134e0daabfff4997b9aefe22c4de183

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQm:CTWn1++PJHJXA/OsIZfzc3/Q8DNcfNr4

Score
9/10

Malware Config

Signatures

  • Renames multiple (1630) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4656
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1268 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2612

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

      Filesize

      52KB

      MD5

      9b0588f56ecd252f7636b08203a0be9d

      SHA1

      194cf2640d071d658e3a82fb44af75bfb1616109

      SHA256

      e5a960dfaad6588a16280cd888d6cde54d5cfced001d321813120d28f0b13230

      SHA512

      c50b83e7f1813741d6dacf05a8687ef538253f3c34c9c069e51c8bb44e40c1a77c665df2ec4cc0e2cb2c7bd1e9b94db92b191c13477a18402ac97d5cbe54a5f9

    • C:\libsmartscreen.dll.tmp

      Filesize

      52KB

      MD5

      cda0e57b35852381be9b9533bd58e448

      SHA1

      a097f180a5dc648be2443dc5fc12c1094472f5be

      SHA256

      a0a7205619d99ff456687fb2120b198eb248d0cd7f1a9e2bdf6d58bba2ac49e8

      SHA512

      a37b469a872bad69a84c9be957c5c2386e1a875e694aa34bf51ee62c3ca73e66518c3a11fc98d4e523a2f421ad11a3910f2381b969f5a0ffa28df1e8c5eb90b3

    • memory/4656-0-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/4656-310-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB