Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 02:36
Behavioral task
behavioral1
Sample
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe
-
Size
189KB
-
MD5
57b502ae4fd0e0e29b3123354fb703c0
-
SHA1
d0bdff08805ddc658bfb97fe8f2571faadf6d2e7
-
SHA256
2b479fd15fb09fac73d6f59387d6c09d9a5f9ac4391287bc82ccf99b0d934202
-
SHA512
0d4502b6f96d76e5a48a202f4848b6190adadb141c4e0eee001e8d68d4d7b9457cbe43bb994fd860c3d0349b1c9ce65ae4fa70590b1e617518900377532ddc3b
-
SSDEEP
3072:KQSoskRY+E9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Exy:KQSo1Yx95pK7ShcHUaN
Malware Config
Signatures
-
Renames multiple (3747) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
_clist.exeZombie.exepid process 3052 _clist.exe 2488 Zombie.exe -
Loads dropped DLL 3 IoCs
Processes:
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exepid process 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/3040-0-0x0000000000400000-0x000000000040A000-memory.dmp upx \Windows\SysWOW64\Zombie.exe upx behavioral1/memory/3040-9-0x00000000002E0000-0x00000000002EA000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp upx behavioral1/memory/2488-19-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Zombie.exe 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Zombie.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\release.tmp Zombie.exe File created C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp Zombie.exe File created C:\Program Files\GetRegister.otf.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\gadget.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exedescription pid process target process PID 3040 wrote to memory of 3052 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe _clist.exe PID 3040 wrote to memory of 3052 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe _clist.exe PID 3040 wrote to memory of 3052 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe _clist.exe PID 3040 wrote to memory of 3052 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe _clist.exe PID 3040 wrote to memory of 2488 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe PID 3040 wrote to memory of 2488 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe PID 3040 wrote to memory of 2488 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe PID 3040 wrote to memory of 2488 3040 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_clist.exe"_clist.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmpFilesize
46KB
MD57d2355249a6f308ff4b290eac1e9bd44
SHA12af978feae32ddaae563ee4a658d62d9f7f76795
SHA2562a4b5a1109abfbb530b604683e393399026a6e723f6b8c9a0f9641934d0b063f
SHA512b6b39cd9723a27bc27974cb34226d5ca0fd2c4344b972fa297a50f125bc53964baeb936ceaf01f150d1c756775c343e251a2f5cc7cdb96a06237fb17ed795865
-
\Users\Admin\AppData\Local\Temp\_clist.exeFilesize
143KB
MD5b27ea830fb39bc056e65f9a2260ae216
SHA1b69e40ee5cabe0721d2d1e9fbdd4088fd87592d6
SHA256fb7fab836f744d669451dcd38aa7d2a9c74c6af893c258d079439b58abce70d8
SHA51222cad79d90a949174828ee5e3ce621113591c7c991c55c1a6a44a4555002adeb3bcbd9bab6cfbbfdefd663b76ac2dae96d70a01c527b312c7e8d223334a30219
-
\Windows\SysWOW64\Zombie.exeFilesize
45KB
MD52318fea0eba3f23050117616a85196dc
SHA1bf49182c7c6313508a7dc90c9c17b40e2088f855
SHA25639f5a3b741123f3dcd067112eae796a219bc2192ea421e81908371efd691a052
SHA5124f4105dc52655d1afc0d6732d9d6323d08431f27c3351dff82a39c19585543064814d791631d0c1aee23e19301f8c96dca0d3168b29d67938046e96f2199bfc0
-
memory/2488-19-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3040-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3040-9-0x00000000002E0000-0x00000000002EA000-memory.dmpFilesize
40KB
-
memory/3040-18-0x00000000002E0000-0x00000000002EA000-memory.dmpFilesize
40KB
-
memory/3052-23-0x000007FEF5693000-0x000007FEF5694000-memory.dmpFilesize
4KB
-
memory/3052-24-0x0000000000D90000-0x0000000000DB8000-memory.dmpFilesize
160KB