Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 04:32

General

  • Target

    4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    4919bebe9f5de22b95aabea2959df730

  • SHA1

    b994cae414dee862eb44939800f0c7fda93ce222

  • SHA256

    8ad3c97ecb1966015416881c846f7603bf9647645d78ca335ec360b6fd072041

  • SHA512

    c6ba4f952b3ec7722f5740f2792f253565c54b759c86c3962a7c208bd9a6436b374c2c71d28e84db6276541818e6e4a3fabd3048913dc7693cdd633af5c6733d

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8cTWn1++PJHJXA/OsIZfzc3/Q86:fnyiQSorQSod

Score
9/10

Malware Config

Signatures

  • Renames multiple (3460) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    114KB

    MD5

    1b663b0d4f49156945e3dcc0c5b281ec

    SHA1

    3738fdcf50a33abed48c5e60aa8c3d1fbcb777f5

    SHA256

    4847b4695ab94496ac6270e210234bbd149923b32de4a8ac81bea1279d49e313

    SHA512

    000f2374646863da6abd18aa3cd229c076288225876c015eb6a1e26840a19b1a7066098d00f5dd0cbd1f6adf044f19781f59e4c110cbfd9388fc06025de32ed1

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    123KB

    MD5

    982896b1f582d4410afa37f32c278144

    SHA1

    41f6d11dc7e864d299446a4293202e39b9f57abe

    SHA256

    275e3859e883f1cc8495a1ccb5389002b0ff9af50ae4089c0942ec24999a9975

    SHA512

    b18d197e79dd960b9294eaafdbb2ce8d5e78ea6eaa1c0c9e6afe56fecaf41c57fe166167a9c3562cf2f8b5e9388050a2de1b81a44b5c3cc3afba6759c7b6e0b0

  • memory/2084-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2084-646-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB