Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 04:32

General

  • Target

    4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    4919bebe9f5de22b95aabea2959df730

  • SHA1

    b994cae414dee862eb44939800f0c7fda93ce222

  • SHA256

    8ad3c97ecb1966015416881c846f7603bf9647645d78ca335ec360b6fd072041

  • SHA512

    c6ba4f952b3ec7722f5740f2792f253565c54b759c86c3962a7c208bd9a6436b374c2c71d28e84db6276541818e6e4a3fabd3048913dc7693cdd633af5c6733d

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8cTWn1++PJHJXA/OsIZfzc3/Q86:fnyiQSorQSod

Score
9/10

Malware Config

Signatures

  • Renames multiple (4821) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp

    Filesize

    114KB

    MD5

    4cb80e91057a71097f167f6f1adc80a6

    SHA1

    783941f2f213ee94d9fd9af4b058679692555327

    SHA256

    c189b5d3c55a76c304c7a63c2173ee315981720048cac007e5724c7d5ecc80f1

    SHA512

    c200374303d525e4c58bf883e5127f2e0c27ebf7ff5c89f4e4aa25be42e1516359d79a6a46c8ff4a9cf77af6e884517143302266086c74971b71a6bad6446dc7

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    213KB

    MD5

    39f56d4ad650ad19f2644e4953264480

    SHA1

    3a696a1e2c16376675ad55c67743ae22e524e9ec

    SHA256

    beb5b37903585405147d782f235fea1cf1f3a9df975d917384b938e9dbd57a88

    SHA512

    14ccc9e992fcd2f9c0de407ce900fcbb97a5b4dd7558962e5152bdcc5dc28280441f3edb9560e2a111a7678dc287c160aaa5ca1adaf4c3d17d1a6f2ada724a17

  • memory/4500-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4500-1710-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB