Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 11:56

General

  • Target

    389a1e6b4c0167a1cc9169ad5a8e7ff0_NeikiAnalytics.exe

  • Size

    85KB

  • MD5

    389a1e6b4c0167a1cc9169ad5a8e7ff0

  • SHA1

    c557a5cd0087c08846f31ea9013a67fc30381f80

  • SHA256

    36fe7f45211e220a4d5bc40b020c368da3cfd673ac32d566e2126f1ea9927597

  • SHA512

    c67579ca2d9911128d4279273bd4985654fa56d0761430893590ebb62ec9937e35efe15b993c3e1ed0864f5703d43f0fad018092427fe7601d4f14435762896b

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IZZG:fnyiQSohsUsWU9BK3K

Score
9/10

Malware Config

Signatures

  • Renames multiple (3545) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\389a1e6b4c0167a1cc9169ad5a8e7ff0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\389a1e6b4c0167a1cc9169ad5a8e7ff0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    85KB

    MD5

    ec8d1a708fd3b80009d726904438e64c

    SHA1

    9f362e16e94b72df17aa6ad5bd7295a2692e6cb7

    SHA256

    4e9ccf021ff39d829e77361fd833ce1aa0d92a3b48bba1bf913608de68aecb36

    SHA512

    18e65b8f604bc2bf07ba1aa851d791d2e707018dd6605d40eaa00e8c8b49ba9013281f3bd33556f98c79b550d2da4b3de4ad5374f4aee7fc5f0b5eb02cca4c19

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    94KB

    MD5

    ac8ebe6e966734e91e08aaec659d020f

    SHA1

    7970a7ba92bdb1a2a3b770c273ce758e7bbfbe6a

    SHA256

    c491f36860404898160a1d89b6721ed9343c4f73c96fb57229c7a3e86b026ad0

    SHA512

    1dc9ff61063ce6c95033ae95001ba8b8de699f10e611d69d78467dd14d2efa94f1b500da61f141aba1ee46c0564b024925be776a0338529dc8157a6b463bc363

  • memory/2240-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2240-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB