Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27/06/2024, 04:49

General

  • Target

    4f0bea45d28c0b59e9658317322c09f95e265b1f7702a5774dfa33084f7a6c37_NeikiAnalytics.exe

  • Size

    46KB

  • MD5

    c8b8305205989d38c24a245a0fdbc9e0

  • SHA1

    4390eccd63af0e791115bc093ef45b51b7b066b3

  • SHA256

    4f0bea45d28c0b59e9658317322c09f95e265b1f7702a5774dfa33084f7a6c37

  • SHA512

    9537602d47397aa2ce927e1f455add6340544407e786b29434a7a1037994352c8b73f0a64e11ad5af59aef454fd967a2412fa466425c9795e99478028d7b1532

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzC:CTWn1++PJHJXA/OsIZfzc3/Q8zxM

Score
9/10

Malware Config

Signatures

  • Renames multiple (3805) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f0bea45d28c0b59e9658317322c09f95e265b1f7702a5774dfa33084f7a6c37_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4f0bea45d28c0b59e9658317322c09f95e265b1f7702a5774dfa33084f7a6c37_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    baaee7a647be8f8d4b431f6904e39e02

    SHA1

    d3303a24ddcbcf394aea1cc7cc230409bb65122f

    SHA256

    2246625e5eb38ef93de1e7f4c34a96c79378a86b8d325ab6be6665df92a96eb0

    SHA512

    1cc9cbc1a6303965d05aa6e140d5d02db5e6c2fcd8e57a77bfa03e48d74bbc0df062e644d305cfa9acfc1e0e42adea83eda5825989f456a28cbfb3b6b722742b

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    55KB

    MD5

    af14c6694cb26202f1997c3cf97aa879

    SHA1

    c180b397c198a5f3bd75b8304865ba722aa9a04e

    SHA256

    49a51801a8345beaf901438cddad0a4c69a7892205440cf31ccb521e7e5576cf

    SHA512

    78c99f45e8c1c02d4a918e03f396af35924985271fe5087713be72911c87ab5f63ffc6d9d21e6c619d095bdf262e6893481fcfabceb64368f660ec2510c546ca

  • memory/2956-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2956-80-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB