Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe
- Size 499KB
- Sample240611-demb7asdnl
- SHA256 cb0774b2436d241112996d10ff8cb962d6e461d49fb6b0e16423d07a895b241a
- MD5 2514b379f34a15b6955ce402b8e52730
- SHA1 6dc584ff0740c8dae099d358afc58abe0e0859c2
- SHA512 dfdabb47b47d1b9abc8837af4fb6f9e29e9afc1fa64d6d4d9c4fe560d421795d6901270b33a53cb314f1dd8db6edb2d5c9f241f02e22126d335ef33efdce45c6
- SSDEEP 12288:u0md3/94A2p8GnqZycIr+VtKzv46OgRhKB0OrJQ:ux/WnSyhbzvZOqU1u
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 3 IoCs
pid Process 1824 Zombie.exe 5000 _vcredist_x64.exe 1440 _vcredist_x64.exe - Loads dropped DLL 1 IoCs
pid Process 1440 _vcredist_x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Zombie.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-convert-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp Zombie.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4808 wrote to memory of 1824 4808 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe 82 PID 4808 wrote to memory of 1824 4808 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe 82 PID 4808 wrote to memory of 1824 4808 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe 82 PID 4808 wrote to memory of 5000 4808 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe 83 PID 4808 wrote to memory of 5000 4808 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe 83 PID 4808 wrote to memory of 5000 4808 2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe 83 PID 5000 wrote to memory of 1440 5000 _vcredist_x64.exe 84 PID 5000 wrote to memory of 1440 5000 _vcredist_x64.exe 84 PID 5000 wrote to memory of 1440 5000 _vcredist_x64.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2514b379f34a15b6955ce402b8e52730_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe"_vcredist_x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe" -burn.unelevated BurnPipe.{5E5C2754-EE33-414A-A035-CB1E0CF4EE0C} {6BDD096E-7DE7-43BF-81B9-4C6ABE22A44E} 50003⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 55KB
- SHA256 7619f4064723fb2a1aa164531345162fc98e76c7d699d13a643e0c11f4817298
- MD5 7a6ee0286dbc1f62ab28004d6e1e219b
- SHA1 8c808246c01b057ff188dbbb93496d57c66b930d
- SHA512 d9bf810abcca0a15ec621e2c166df42accfaa69d16d9f108ea6a0aa53c5eba27bb5b83c0632442a7e56183503225ff12be8298660d01f0b02b8c86181a805eab
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJc8EXBwzEXBwp:/7ZQpApze+eJfFpsJOfFpsJ3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe
- Size 443KB
- SHA256 f351b8e3d5dafb36b7ee16146e66f8ca7ecef751a0c5aaf5356315e9f613fc72
- MD5 38410cefc9ef3c7ffc63ac3731658e3d
- SHA1 d8638f21d2cfb5d5b89883d8ef0c540dedb85692
- SHA512 d17ce1ec319be3582c4153eceb94e43adb94bc3f5c8bfebb5883cb425fe4a274cfd1a1ce1321c7b9b6a9695c1bc573f0702072a74cca2b932998b8de94e75e6d
- SSDEEP 12288:w0md3/94A2p8GnqZycIr+VtKzv46OgRhKB0OrJX:wx/WnSyhbzvZOqU1F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{a1909659-0a08-4554-8af1-2175904903a1}\.ba1\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{a1909659-0a08-4554-8af1-2175904903a1}\.ba1\wixstdba.dll
- Size 126KB
- SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
- MD5 d7bf29763354eda154aad637017b5483
- SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
- SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
- SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 55KB
- SHA256 645133be63bdd67a3d252fa292d2539f516eab4b398a9c44253db57a45a3b7da
- MD5 d1ca5bf74c2be7f82f474189183e625c
- SHA1 5cb6f1fc110d50208cf2e25e1c40d4a17e0a99a5
- SHA512 f00a5b9bfa1c97fb4bd9a3781bb6370973a92737d7f0092beb81fca0a9d6658cf1864542678fefe16b6829445d6c37413584f82210749931e68b0c74e0aeb3dd
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJc8EXBwzEXBwo:/7ZQpApze+eJfFpsJOfFpsJa
- MD5 SHA1 SHA512 SSDEEP