Overview

overview

10

Static

static

3

21353d65b4...cs.exe

windows10-2004-x64

10

Resubmissions

16/07/2024, 16:17

240716-trljes1akl 10

16/07/2024, 16:15

240716-tqbb3azhpn 10

17/05/2024, 19:31

240517-x8wmhafa6s 10

Analysis

  • max time kernel
    224s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 16:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe

  • Size

    6.0MB

  • MD5

    21353d65b457518570bffc8a03038ee0

  • SHA1

    b0c2e8ff737a4d3c331a5a581f7042eed4f69a9d

  • SHA256

    98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39

  • SHA512

    a3a478a92fd5a1762e00f1adcac2d9f8ac8868b82c0e2e3cbddbc441333697d82e079fe3526ae4b67c5a674b4ff39229cb9c85f60f278525346c0f2d8804c282

  • SSDEEP

    98304:xCl55swBqKJJLlcu2vwYyCfD8+tetZOVN+zhDH+dYaEoSu:qnBqxlxfD8+tetZYMzNH+dYaHS

Score
10/10
evasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Libraries\HOW_TO_RECOVER_FILES.txt

Ransom Note
Your network has been chosen for Security Audit by EMBARGO Team. We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems. You must contact us before the deadline 2024-05-21 06:25:37 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/ Do not modify any files or file extensions. Your data maybe lost forever. Instructions: 1. Download torbrowser: https://www.torproject.org/download/ 2. Go to your registration link: ================================= http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8 ================================= 3. Register an account then login If you have problems with this instructions, you can contact us on TOX: 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47 After payment for our services, you will receive: - decrypt app for all systems - proof that we delete your data from our systems - full detail pentest report - 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan IMPORTANT: After 2024-05-21 06:25:37 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed. If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers. WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators. If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.
URLs

http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/

http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Renames multiple (7430) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
    C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe --help
    1⤵
      PID:2056
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
        21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe -t
        2⤵
          PID:1568
        • C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
          21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe --help
          2⤵
            PID:636
          • C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
            21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe -l -v -m
            2⤵
            • Drops startup file
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1160
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /q /c bcdedit /set {default} recoveryenabled no
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5288
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:1976
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /q /c ping localhost -n 5 > nul & del C:\Users\Admin\AppData\Local\Temp\21353d65b457518570bffc8a03038ee0_NeikiAnalytics.exe
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:7152
              • C:\Windows\SysWOW64\PING.EXE
                ping localhost -n 5
                4⤵
                • Runs ping.exe
                PID:1552
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:6072
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\debug\NetSetup.LOG
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:4852
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\debug\PASSWD.LOG
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:6856
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\debug\sammui.log
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:2060

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\db-journal.564ba1.partial
            Filesize

            160B

            MD5

            1d0fc139a677f9c9a1e10220d3511dbd

            SHA1

            cd4bda65c4800034130209efa0239b57b9722701

            SHA256

            358a56c3ca1189c920178e8c6b49ff8b09999412def6652ccde6edd1abf85a17

            SHA512

            e2d1c9bcc0e348b9d41722ec9573418efb715a6ae1cb80b1d9941afd5103cab1a5f37316f34a33d2243952973f07a181c93ed23cb8f8c19be6c142a13d1f5aba

            Download Submit

          • C:\Users\Public\Libraries\HOW_TO_RECOVER_FILES.txt
            Filesize

            1KB

            MD5

            760746c6bc18a85e7503567571fa6d8a

            SHA1

            0dfdce0bbc0c3aa4fa0507c40d4c14968fb28834

            SHA256

            a9db836bdbf007aa6b13cfb9ad280be457138db4464990356d682128c3d2a0be

            SHA512

            ff3f665660147120ba66bdbe472841a7f96daa81ca760c36c79cafa8216d5e8eb097f202ebfde5e0dc9ab761fb2ce72b3fb09aa854c872f9961e8f388f097ee7

            Download Submit

          • memory/636-2-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1160-5764-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1160-9801-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1160-14611-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1160-25479-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1160-25668-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/1568-1-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/2056-0-0x0000000000D80000-0x0000000001390000-memory.dmp

            Filesize

            6.1MB

            Download