Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 02:36
Behavioral task
behavioral1
Sample
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe
-
Size
189KB
-
MD5
57b502ae4fd0e0e29b3123354fb703c0
-
SHA1
d0bdff08805ddc658bfb97fe8f2571faadf6d2e7
-
SHA256
2b479fd15fb09fac73d6f59387d6c09d9a5f9ac4391287bc82ccf99b0d934202
-
SHA512
0d4502b6f96d76e5a48a202f4848b6190adadb141c4e0eee001e8d68d4d7b9457cbe43bb994fd860c3d0349b1c9ce65ae4fa70590b1e617518900377532ddc3b
-
SSDEEP
3072:KQSoskRY+E9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Exy:KQSo1Yx95pK7ShcHUaN
Malware Config
Signatures
-
Renames multiple (5190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
Zombie.exe_clist.exepid process 2128 Zombie.exe 4844 _clist.exe -
Processes:
resource yara_rule behavioral2/memory/4128-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\Windows\SysWOW64\Zombie.exe upx C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.exe upx behavioral2/memory/4128-24-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Zombie.exe 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Zombie.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Zombie.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\release.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp Zombie.exe File created C:\Program Files\7-Zip\License.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exedescription pid process target process PID 4128 wrote to memory of 2128 4128 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe PID 4128 wrote to memory of 2128 4128 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe PID 4128 wrote to memory of 2128 4128 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe Zombie.exe PID 4128 wrote to memory of 4844 4128 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe _clist.exe PID 4128 wrote to memory of 4844 4128 57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe _clist.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57b502ae4fd0e0e29b3123354fb703c0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\_clist.exe"_clist.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.exeFilesize
46KB
MD518568f2a38b3eb95fbffef78a542e5ea
SHA1769c6f3bf510dccb0df0476abb2abe734ad4bee1
SHA256db390c8cd5de6a5bc93eb72b932e053aa621e78b566a9a2955053a02d55226ad
SHA512f0a726b44a9a2ad1c8d7ddc2b2251067856009c6f4779b394e6f0b2cd998e1aeee519602b333ecfcc784f83018c268a063d560689f5e6085fd9ed8c3430e9c53
-
C:\Users\Admin\AppData\Local\Temp\_clist.exeFilesize
143KB
MD5b27ea830fb39bc056e65f9a2260ae216
SHA1b69e40ee5cabe0721d2d1e9fbdd4088fd87592d6
SHA256fb7fab836f744d669451dcd38aa7d2a9c74c6af893c258d079439b58abce70d8
SHA51222cad79d90a949174828ee5e3ce621113591c7c991c55c1a6a44a4555002adeb3bcbd9bab6cfbbfdefd663b76ac2dae96d70a01c527b312c7e8d223334a30219
-
C:\Windows\SysWOW64\Zombie.exeFilesize
45KB
MD52318fea0eba3f23050117616a85196dc
SHA1bf49182c7c6313508a7dc90c9c17b40e2088f855
SHA25639f5a3b741123f3dcd067112eae796a219bc2192ea421e81908371efd691a052
SHA5124f4105dc52655d1afc0d6732d9d6323d08431f27c3351dff82a39c19585543064814d791631d0c1aee23e19301f8c96dca0d3168b29d67938046e96f2199bfc0
-
memory/4128-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4128-24-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4844-20-0x0000000000740000-0x0000000000768000-memory.dmpFilesize
160KB
-
memory/4844-21-0x00007FF93ADA3000-0x00007FF93ADA5000-memory.dmpFilesize
8KB