Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 03:35

General

  • Target

    769e75a3c7372d289ef5ae598155a5d9c50a873e32431196228bf210eb154258_NeikiAnalytics.exe

  • Size

    7.3MB

  • MD5

    6729048bb8f383f975b4980a8f2c4d90

  • SHA1

    a1b5311179da5a7e39eba257d9c9e16ab0bfc2aa

  • SHA256

    769e75a3c7372d289ef5ae598155a5d9c50a873e32431196228bf210eb154258

  • SHA512

    6eac771add0dd9aa04d4da13a1ae7e0c32d2a336bfcad02cc91d73e0340e834e86e81befbd931dbb08eb71b8ba220e8ccb60573a5c4004f99cfa88fd62322ad6

  • SSDEEP

    98304:QtzqBZMMEM0MUMRMxMwMkfqbjxbSzGVr4W11/KsZfGpWqOJwNC:CqBZtlV1qKpkfqbjeGVr4wZfNnJwo

Score
9/10

Malware Config

Signatures

  • Renames multiple (5188) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\769e75a3c7372d289ef5ae598155a5d9c50a873e32431196228bf210eb154258_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\769e75a3c7372d289ef5ae598155a5d9c50a873e32431196228bf210eb154258_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3164
    • C:\Users\Admin\AppData\Local\Temp\_choco.exe
      "_choco.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp

    Filesize

    17KB

    MD5

    c258dfa354041e54564c2b2b0b51092a

    SHA1

    428ff406ad418583c9622b5950210971f780fbdf

    SHA256

    24505a2763092e5f99d596e4f69a6c0a8ef1d74745afd76f22e72d7c02707f56

    SHA512

    ca5c61a5e56de1c5dc5534014b1c927e337a6330b7536ddb343e0164304bc5cf9014e1a276cb4e07e6c648d087ddcb2dcf75192b3991cfc56a1c06ebd8ab84ff

  • C:\Users\Admin\AppData\Local\Temp\_choco.exe

    Filesize

    7.3MB

    MD5

    dd6b75a77601d62ac66df1b0a51a7de3

    SHA1

    699fc35deccb0cd6e341420903fc993535c2c98f

    SHA256

    2f46a1d48e1589e0aa10f215e77cb48fb90c531e19aa3c05d766f59b449f3c15

    SHA512

    43bd57e5379c22494aade734a45a443722327d48c7f06aa521048c99adba576e29bd70bba7bd28ba94f8f24f88efed7b8e5a1b3249cbfcb4d95fd0bc1f424d86

  • C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.3728.update

    Filesize

    9KB

    MD5

    14ffcf07375b3952bd3f2fe52bb63c14

    SHA1

    ab2eadde4c614eb8f1f2cae09d989c5746796166

    SHA256

    6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

    SHA512

    14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

  • C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.backup

    Filesize

    809B

    MD5

    8b6737800745d3b99886d013b3392ac3

    SHA1

    bb94da3f294922d9e8d31879f2d145586a182e19

    SHA256

    86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

    SHA512

    654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

  • C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

    Filesize

    2KB

    MD5

    d2a445318de4bc0a88cd23fce683a4d6

    SHA1

    0c60cad123509131637a47216c81df8e654339cb

    SHA256

    5ae2c707c8d3eab289a67d2f7c75649dc82c4fc97318c377cd2d12a5ca0ebfab

    SHA512

    f2454d2bc35d9b2c88de209ca2a117f2e82bc86f17432b394bf13a4ae0e109c606dc9cc544974bce03c93f07eb66735aa692b451882865f034c4ca85c710b9b1

  • C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

    Filesize

    4KB

    MD5

    a7ddf839f487783036ac4c40fe6388e9

    SHA1

    771722f1ed4880593228965f363a2faf0ad06168

    SHA256

    60d188b40b389896ed36f8e99b029f9470c99a67ab295111e0efa67a9b8e797c

    SHA512

    b136661cc9b8e463a11b646ac091a82385f61fe6cb08f1f5a12b9f10ca99c072403d7161df60a4daa71c54ab566a2aa40b744e0d553c06dffc678ac39250928e

  • C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe.ignore

    Filesize

    2B

    MD5

    81051bcc2cf1bedf378224b0a93e2877

    SHA1

    ba8ab5a0280b953aa97435ff8946cbcbb2755a27

    SHA256

    7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

    SHA512

    1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    17KB

    MD5

    b91a12e189a09276e21038f4e5b30546

    SHA1

    00edb2787fc78fca42c3468f437f33a56673071c

    SHA256

    b98ff84ca0782c70c06ee561c8fccee780e575d4e7d6bfa45b86b7f47b31db04

    SHA512

    a79444eb8634e3614b35f9484d4ca649bcc9f7f5ab0507a596e59458f2cda2fc1f05373775b8288bbdb52102a9a92960a8434eee201482b3a586c1a30434f87f

  • memory/1216-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3164-9-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3728-289-0x0000000001B10000-0x0000000001B30000-memory.dmp

    Filesize

    128KB

  • memory/3728-322-0x000000001C150000-0x000000001C1C6000-memory.dmp

    Filesize

    472KB

  • memory/3728-325-0x0000000003480000-0x000000000349E000-memory.dmp

    Filesize

    120KB

  • memory/3728-321-0x000000001BF20000-0x000000001BF70000-memory.dmp

    Filesize

    320KB

  • memory/3728-271-0x00007FF832A60000-0x00007FF833521000-memory.dmp

    Filesize

    10.8MB

  • memory/3728-232-0x0000000000BE0000-0x0000000001326000-memory.dmp

    Filesize

    7.3MB

  • memory/3728-99-0x00007FF832A63000-0x00007FF832A65000-memory.dmp

    Filesize

    8KB

  • memory/3728-440-0x00007FF832A60000-0x00007FF833521000-memory.dmp

    Filesize

    10.8MB