Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 14:03

General

  • Target

    4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe

  • Size

    68KB

  • MD5

    4048dfa5c8639391337e7209cecabae0

  • SHA1

    493354f299ed30ec98e77c7222dd9dbd7b27d48b

  • SHA256

    e9f5dabbd2194a2e845c293fa812dc8aecd1fd61b48b8f48c148718cf0b5932a

  • SHA512

    2e7125a042c9f3c23537c9a9480698c2833989144cd222cf445e8ab73a1c53933a404255ed27ebfe7434af327b688862edf4878dfd3fd3baf52331fc9e58a074

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8w9A:fnyiQSol9A

Score
9/10

Malware Config

Signatures

  • Renames multiple (3739) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    68KB

    MD5

    72f21af507f3b4ab16a729dd7f213e7d

    SHA1

    51b8aa9adba503c25a89ad6c76496e051f58721b

    SHA256

    c53dc874833f18ba42b56c972c92cae5ea08228273950ae1e905a5a7fe707f0c

    SHA512

    14391de1e4b0768efcf88d4e35070678d5b3b02dcb00495a1f59e6933d6f08d82bbe6b3a6ebbf9f62d0d7ef72aecdcc280f5cb1b33f8b3043aee931a732ac920

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    77KB

    MD5

    c11b327ffc569b2fdbb3cc984a9ea0c7

    SHA1

    4c48d6b2daa6154eb6687dd233a3dcb0b33b3ed8

    SHA256

    3c48932fd082d31c54f6f19554a82530da35bc4b2d4992dca4936330b4ebdfb6

    SHA512

    91a99cc8fc24e82d18c1610094044e26e8321d7f4d4e273d32f7ed1996003dbc540434047dfdbc05f6065d7ff341279b64536e20b4e9e4321d14eba32de19f1c

  • memory/2204-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2204-658-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB