Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 11:41

General

  • Target

    376a999a90e1f8d1ba8528e8e8794fb0_NeikiAnalytics.exe

  • Size

    54KB

  • MD5

    376a999a90e1f8d1ba8528e8e8794fb0

  • SHA1

    0801f714cabf4ed1f3db6c45c938f4d30c08e95c

  • SHA256

    7ccbb21a7810fab28f670b813f5bb1a834acdc94cba5d2a66e445adf410a20f4

  • SHA512

    357333f3ab44fa471f06ebea008d8b7adb1ffc17279be0dc5a24dd3712c1eab40ced320484590d032c2966559511ddd9f6e20073c5de4d41dd1ffe35834ef9cd

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQQ:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYZ

Score
9/10

Malware Config

Signatures

  • Renames multiple (5348) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\376a999a90e1f8d1ba8528e8e8794fb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\376a999a90e1f8d1ba8528e8e8794fb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

    Filesize

    54KB

    MD5

    de3dbb859ece5dc49a26de22b807a5c7

    SHA1

    c9f5991fc6a10262d1f1663ba49cf38e8000be2b

    SHA256

    7476c1affa550036b7d904150daffd1fe7c0f9eb75f0dd2f723ce17946441f01

    SHA512

    43d0ec20d926511bec9ed281fa50dec79298fc7feca600d407c6331774b98050e01bbc1698663e17d367756bb7392ef5af4da0067cf66e404ccc73f23c396caa

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    153KB

    MD5

    f44c38f7390c72776c116b765f276b37

    SHA1

    c287a1befccfc40fbbafcb82f5871f857b9d3aa6

    SHA256

    1cc4edf0c94e41b5ec21dd21d42604e3df36919d967693a6e117a290e312b192

    SHA512

    d6f0f24cee46a1430522f6e85c85449d524c38916c691dd626c243abb1594b662f370ec5a7e83a93550328658703709cca87bc7425798c63e093102f9261a2cc

  • memory/1644-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1644-1218-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB