Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 06:34

General

  • Target

    5aa170c483a04ff636acb1e846938290_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    5aa170c483a04ff636acb1e846938290

  • SHA1

    9770d7a5cc7bc6da610d2700ae7287c3d3c4f75e

  • SHA256

    3b3b8c03dc75e294ee764a820f27447145410c894c0697fbb78ab986126b71c5

  • SHA512

    4eb80112f7bf078d09a5c3cafd717167354f73ace5e34b8007375655e30c7b193f1dbc6b549b8e7c935b1d6c9be8933546c14615504434d7be74c19f8bde775e

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8XJU:fnyiQSoUJU

Score
9/10

Malware Config

Signatures

  • Renames multiple (4721) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5aa170c483a04ff636acb1e846938290_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5aa170c483a04ff636acb1e846938290_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    933c619884f1c0e98a9e51d00dfa1060

    SHA1

    4f41ab6e52aa7ae64a6274a81613300285100b20

    SHA256

    685e5bd821da9c90e27e5269ee78343c31659f8fea2dce4cd44cb609a036b751

    SHA512

    18c85d5c599303c17aeeba6fb25afbbf2ddb54186520226d5c4b605d6df65ea939dd94640033e4a6220dc3972cc49cc85eb5815d3ce228f916975c9cb5040c7c

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    172KB

    MD5

    d2ce8d05e06c4191631b4441b16a097b

    SHA1

    41be20c38ebc53c89621882bb2f7df3bdde25e02

    SHA256

    e8cfdcf7f2aa021cd2d513fbf3dc9a38cd274b714a13326a558a333b900b8d7f

    SHA512

    126e051c8b7ddd547ac63e449e4150e66271c0efdc37c88aa283c0f787846f3bfbd5c855c91eaf1d8c36c7f017ddc3651af4817710d094190752d1cf311ac50f

  • memory/3428-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3428-1667-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB