Analysis
- max time kernel
149s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe
- Size 527KB
- Sample240614-nemcasycld
- SHA256 9530b22088bf493b62272c2282f3b2a0be44df8b6c534dd9ff666291fbd170e5
- MD5 bb1b4a6a2bf97c26c318856a1baf3400
- SHA1 5332f81d2480ef9f03fc7f63833c77ace67dd7eb
- SHA512 3c16a35524e8c24fdb98fdc20daf226088009fde02ed81a68e5b4b958c7d04982d98321ec4c1b7c2e929b966732bd6166bd7cb1747486423f908be3a100fbc99
- SSDEEP 12288:6ymOcB+pwPprnVmLmDsC+FU+ZOSzt9tzZx:6LOsDFncLmKDZOSzXFZx
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 3 IoCs
pid Process 4864 Zombie.exe 3848 _vcredist_x64.exe 2488 _vcredist_x64.exe - Loads dropped DLL 1 IoCs
pid Process 2488 _vcredist_x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es-419.pak.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BKANT.TTF.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGI.TTF.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\LICENSE.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 796 wrote to memory of 4864 796 bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe 81 PID 796 wrote to memory of 4864 796 bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe 81 PID 796 wrote to memory of 4864 796 bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe 81 PID 796 wrote to memory of 3848 796 bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe 82 PID 796 wrote to memory of 3848 796 bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe 82 PID 796 wrote to memory of 3848 796 bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe 82 PID 3848 wrote to memory of 2488 3848 _vcredist_x64.exe 83 PID 3848 wrote to memory of 2488 3848 _vcredist_x64.exe 83 PID 3848 wrote to memory of 2488 3848 _vcredist_x64.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bb1b4a6a2bf97c26c318856a1baf3400_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4864
-
-
C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe"_vcredist_x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe" -burn.unelevated BurnPipe.{1D9280B4-8CBA-4029-B4E0-D4BB2E3923D8} {2038E4F4-9B4B-40BC-8CB6-3AA47D2F9284} 38483⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.exe
- Size 76KB
- SHA256 7d51095eee2b65438f5f0b5ff0a4c40acbe7f7718cd26074333ef7a2acd43ac8
- MD5 80e308a6ba4e7750f941429d0ee51491
- SHA1 9534b1ab35f7332651a8287539226ec394e22e1c
- SHA512 156097ff8d974d13376069dca8efa6a397dd00ecce7e02c058277609b7e5b097a1478460efd9a5520743dd2b59c38754e492adbbc67be27c3b37697e0efab34d
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76uSb:6e7WpP9oVLQthbYY9oVLQthbUvE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_vcredist_x64.exe
- Size 450KB
- SHA256 18e6d3d96fcd39ba069c0e6ebc108881ec5bb07e29a24b0177688ce391dac526
- MD5 e16e6d68ce1949c9721656390f47ce07
- SHA1 9009cca5dc05e22f4cf0d8529a473f19b363103b
- SHA512 63a179e4db0cb7954ddc9aee9e3c7aecae9e160154243b248b94647eb8defafb7041ee291f6f880dc3ca7f298dd548e4b3cf0b650e9a7e34f34d2d2f0dd36127
- SSDEEP 12288:IymOcB+pwPprnVmLmDsC+FU+ZOSzt9tzZ:ILOsDFncLmKDZOSzXFZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll
- Size 117KB
- SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
- MD5 a52e5220efb60813b31a82d101a97dcb
- SHA1 56e16e4df0944cb07e73a01301886644f062d79b
- SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
- SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 76KB
- SHA256 b770c9146deac1d6955c01c131db56bebc11728d00b78df9232c2b65200b35ae
- MD5 08a9263db33ec03b42b4b72044f3a439
- SHA1 a7e728cc8318f0ed20f2b09a77cf640a35bcd60d
- SHA512 2fd53ba0cb1713a2e48709bff79398e6684b2b9b4135e47651f7db6e877be6e6ad99bad7554180c5aacd4b7c84ec3e804621f1cf19218c3f16778ed890a8f583
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76uSc:6e7WpP9oVLQthbYY9oVLQthbUvv
- MD5 SHA1 SHA512 SSDEEP