Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe
- Size 187KB
- Sample240613-a3721s1err
- SHA256 617bd345473ec96be8d467c34e1b20457ee284153966c540bf4eb122de730254
- MD5 51374b391b75981a0f76bfffe2b2cf30
- SHA1 d6977059b03d06313c20c12514191a809af2319b
- SHA512 f437a434465fa7abafc66ad7cf0e5478647d1623029284744b77e56f242b2692d00d19c05dd7ad18f44e2ba353cc80bf79cd3dd18d312b0db4b6522882437948
- SSDEEP 3072:6NLWpCZLY0w9mHpKZNGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2ZTxH:u6SYP9UpK7ShcHUaZJ
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1564 Zombie.exe 428 _cinst.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp120.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\README.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp Zombie.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4580 wrote to memory of 1564 4580 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe 82 PID 4580 wrote to memory of 1564 4580 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe 82 PID 4580 wrote to memory of 1564 4580 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe 82 PID 4580 wrote to memory of 428 4580 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe 83 PID 4580 wrote to memory of 428 4580 51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51374b391b75981a0f76bfffe2b2cf30_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\_cinst.exe"_cinst.exe"2⤵
- Executes dropped EXE
PID:428
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe
- Size 44KB
- SHA256 8e5922b1665e73b4493833c93eb6af34a588ceeb6a0297020a4781a7e8711f91
- MD5 4598c26b632b8061febd3a5da4faec65
- SHA1 90e3c19b2112ae5b32715c11a487396fac397c2c
- SHA512 82ba4d951a116eec1ce5c6f2cc710ad1a9e45299c26f09e3ea5e870e680075de44a6f9938191ee9a9e5726ef74f314c4a486a01f0ede67521b0bf73858108596
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDX:W7BlpNLpARFbhblkYlkuvIYFWcDYcDX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_cinst.exe
- Size 143KB
- SHA256 80d7ec8ce3913d81ea5d4f304b8609e56f0e49778c52af9279e742ea54f4a155
- MD5 2fdb371d45181dff59577110ba1064e2
- SHA1 42a5833cb0ac90e38d734d1327bb3f7c7a6aa453
- SHA512 52982041ba9ca552b90b79b251501ec6c33c5251d09ca9969a1b179af2ec17aca6eb81db6e588e12751bcea04208e1da8d5a754a979dd98ceb3f50780aadea20
- SSDEEP 3072:9w9mHpKZNGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2ZTxA:K9UpK7ShcHUaZO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 44KB
- SHA256 95c250dc8745cb69fe08e8cca3a2013720be9a3871fafd65c28c94fc9621cdba
- MD5 71d3eee3b8314c23cf94d51b102751b0
- SHA1 f30947a064b5434c2c4e1b8f14d11d07072b89b5
- SHA512 c926167e57f943cd886a7c06c41f6b86a4e468075801eb48be1e1b6974134accd078871d1ad6605941d2207d8eba65d0f7accde759ba15236b9ebca27468e015
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDP:W7BlpNLpARFbhblkYlkuvIYFWcDYcDP
- MD5 SHA1 SHA512 SSDEEP