Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 12:56

General

  • Target

    3c20a98584d3643532cf4f67d9a68d00_NeikiAnalytics.exe

  • Size

    88KB

  • MD5

    3c20a98584d3643532cf4f67d9a68d00

  • SHA1

    1cd9430360aa9153dac2892eb135bb45c7f4ea27

  • SHA256

    edf1270237e127d44b318d9fdaa36b30ef0b614f3f17b9d7f8aed1bd12d33800

  • SHA512

    c97421949cc712e1ff665386a9421302e35ad6a13ba8e028a2a5cbd53f38ed127ad3c6b92dec5e8523de3e12bcbdc0710a6ae9a233a5d1844c9b12331cf625b9

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqP2:6DWpwE7oL2e+efZwZ08i8o

Score
9/10

Malware Config

Signatures

  • Renames multiple (5186) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c20a98584d3643532cf4f67d9a68d00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3c20a98584d3643532cf4f67d9a68d00_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    88KB

    MD5

    fa112ea6f129500a306a15f8ab39eb4c

    SHA1

    5dab17d9af77f77f04e3cdd5f572c17472a78959

    SHA256

    73e773ff879c6ddd956552e4fdae96061f78c4f9282d0cb682232612243f1faf

    SHA512

    1e532ee70964fb82867468fbc4fb0c8714aab586bc02d783317109e7a64da7bd235dc00e752c95e4e2a48c41a44acc2f71d44a504300d427c7c21ac45956d47a

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    187KB

    MD5

    66fb943b0bd9e04e5577aeaa2172da35

    SHA1

    c0cb493c5a4f713f4a2356698d655487dc1464b6

    SHA256

    3d5c2ce00a53f5baed5e6426f1f1eca3fc00ac56d19383d2cb6133d0b0e3ebe8

    SHA512

    4d1795ff8e40b9cbc6b48934260e2e04239ddcb7d68f4066c5a4715715d7223766183e7e205d7e81a71644bae6ce15530a2d1fde7ba9fc3bb1a8e00541411cfd