Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 11:50

General

  • Target

    3822ef5970f138aef0c6e7dc27ced7c0_NeikiAnalytics.exe

  • Size

    89KB

  • MD5

    3822ef5970f138aef0c6e7dc27ced7c0

  • SHA1

    ff156c9e5fe14511ec53a02ebdf6af155c101711

  • SHA256

    b7786390ef426d07d9fb5f99871606a192539f8f2fc9f17780d51a23e0d3d399

  • SHA512

    6d4c1802eab54d5a783920eaadf7da74274e5c8b7efb51e7181b291f16488d2a58cc19a736731cab42fdba6afdc910622e1db79ad11bb026a94983153e68fa15

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97nH5Zv:fnyiQSohsUsxe+erZZZv

Score
9/10

Malware Config

Signatures

  • Renames multiple (3550) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3822ef5970f138aef0c6e7dc27ced7c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3822ef5970f138aef0c6e7dc27ced7c0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    89KB

    MD5

    b78be610fb182a997576eeef822895da

    SHA1

    f88529eeb8dad0b6032aef9ebcc93b12b75c7842

    SHA256

    794ff7bea1d060758923a65f385a1f98bf05eb51ab9466b4142a52f8889854c0

    SHA512

    0b76447a842b54e4c69b638239627d7cfee18281df6590a8eaf57bdc7c9d2b7e60751ea413a49328e3a7de34cce1ff737f931fbde2373000d5e452731a6b03e9

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    98KB

    MD5

    5a5c94f229b336ec09daf2d71c148aad

    SHA1

    4f3edef9d7ec921b3ce960476f0014d322a9e631

    SHA256

    c9aa59c8f26e4a094622f656a3f6ad23597ea09e816e37ad1df45684007a7ecc

    SHA512

    c30a90a3c97291867fe7cdc7859bcaf5546bbd012b86fbe0bf28ad6436972c9c2371616a88aa8488a6d4c0075fa70eee3d8c9324350fc3959c1844a0c17e63d9

  • memory/2208-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2208-652-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB