Analysis
- max time kernel
150s - max time network
58s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 09:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30a7dac39276748aae12736d87760970_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
30a7dac39276748aae12736d87760970_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe
- Size 189KB
- Sample240611-lvr7datamr
- SHA256 677c94efbffe5a7fd7ede0b814e9a1ce83b9b12bda9255b990c42f6207f29fac
- MD5 30a7dac39276748aae12736d87760970
- SHA1 8862559d6807262c7ff77b05c8b8fade6fb289f6
- SHA512 d1b521bd79e5d3690ab683c0789f9ec1d86d38a8ce38f210e5580b35996fdcc645ebf7bc8bcd695fb71b05b117c7e6ee3a11e6ed7a4c5777d2ff8ab77411cbea
- SSDEEP 3072:9QWpze+eJfFpsJOfFpsJZD98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2w:Lpe+eE9GpKbShcHUaw
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5351) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 932 _choco.exe 4908 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp Zombie.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\hxds.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp Zombie.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4400 wrote to memory of 932 4400 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe 81 PID 4400 wrote to memory of 932 4400 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe 81 PID 4400 wrote to memory of 4908 4400 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe 82 PID 4400 wrote to memory of 4908 4400 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe 82 PID 4400 wrote to memory of 4908 4400 30a7dac39276748aae12736d87760970_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\30a7dac39276748aae12736d87760970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\30a7dac39276748aae12736d87760970_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\_choco.exe"_choco.exe"2⤵
- Executes dropped EXE
PID:932
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4908
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 47KB
- SHA256 093417278e3f03d60f06ae0b02a45c92f883b61443db0e737317cadbd6af9099
- MD5 22bd6217d679ed079502b4d5ec8f1d46
- SHA1 45ac32e280030ff06cdb64dfa8751656278c7478
- SHA512 a97ecd09e9a6aaac334f5e08a169cb64911c7efd335e0c6ddedc92cca42fa63da5762f6af3496c4d107f4f23a31b1359abfe8d6e770bb041859c32071f11a017
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJc0:/7ZQpApze+eJfFpsJOfFpsJl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_choco.exe
- Size 142KB
- SHA256 8320c7f90f65b48e4031b680506a9579751789ded4d90fa2fbfc2fb7db7e3ec8
- MD5 81a7c181639679983efb07c2dea2ebd0
- SHA1 93370e8e5cb0d89bf6786445f94dd02dbb84b574
- SHA512 599cca13e527c92cdf88df06ed8a01eee1bc602c565ab69e251f7414e19833ce42f0453771bfdf27d16f9f70112835b599d26a6ed92901fdf86bbdf8adf4d2f7
- SSDEEP 3072:jD98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2LxK:f9GpKbShcHUaI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 46KB
- SHA256 f7bab11c2deeaf4c2c8c22ad76a1ab2eaebe0ce2bef16867e2b2c573062b2439
- MD5 452aad9d34884c3bb6f937506a6da106
- SHA1 38d18b8f9e184c7cfead2b540918df505badd3af
- SHA512 15ca280a5ca7773bb0e0195b6580b719eeff75ad39b876cfd37d42d07053703524693396e6e3174c1cdbe551fd578270939b633a6362f1ab1eeba25e4ecc3ec3
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcM:/7ZQpApze+eJfFpsJOfFpsJ5
- MD5 SHA1 SHA512 SSDEEP