Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 06:04

General

  • Target

    56330c4b8bf3f300c3f0b63f4fa825d0_NeikiAnalytics.exe

  • Size

    78KB

  • MD5

    56330c4b8bf3f300c3f0b63f4fa825d0

  • SHA1

    4426564e2627b3f4e4f5494581b3f52fc431c2b8

  • SHA256

    b4924e8c9bab5adc6e77e2e4d4b5b2a1796707e186ea056b37815f5260993c86

  • SHA512

    d3f417553b2ea53db61d811e90b2d67734b9e9e2c2ae097955ffc15f6bdbfcb29f6868e938cb4260ca8b8c1e9bfe735ee5f36d80468093e947a52a06f4b0ff91

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEha:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsv

Score
9/10

Malware Config

Signatures

  • Renames multiple (4856) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56330c4b8bf3f300c3f0b63f4fa825d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\56330c4b8bf3f300c3f0b63f4fa825d0_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.exe

    Filesize

    78KB

    MD5

    a502bb1f6e21a4bd033b5385ae4eb146

    SHA1

    aa6997879c95f987632c7d1fe9dc9e18bdd64efa

    SHA256

    fc3013bd6b406117b9142c3e87de9de01d464e6e6333446c7618c2bafc287f5d

    SHA512

    42481bb5faadc249e04dba897f0af1d423e2fd672265299c9061ec50467a62ef0098b0c6eb21bb2340cc2c066c3048e38248b3bef8c5d2a9a43bc6716686f184

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    77KB

    MD5

    9e1c1243553d048f422ace912520f891

    SHA1

    0184c089ead7c847cbb1c4ff32609c6a9a166b5e

    SHA256

    57fb26202c7f1fad90a97aa541c55589a4f68ddb2a7999e243848fe1ac3410bf

    SHA512

    c8cbe3c9b2998503f8f32a6dba0c34f9f8072f248b5131b4fb3d5d9b1f710524788bfed2fdb700ec067860e7816ec1a9238f9f2634dda16a15b25a53b39d457a