33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe
Size

59KB
MD5

b4c7c8d7ccb5c2d5e7e3cd8029512c50
SHA1

1f28a3522e9013da6b1fb040ea6f0b362b7056d2
SHA256

33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb
SHA512

4a2ebcb544baf67313bfe8d814c4bc1082f4200d39113c7dae3f9d28c2d5da97eb983f4d406b99e0201782545ab438a3692499ae2110981c8c0429b5619d68ab
SSDEEP

768:W7BlpppARFbhFANJKaJKjZP7PKCZapW0/13cYqSC9z/+:W7ZppApoJKaJKjZP7iNpW0/137qSez/+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4659) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_MofCompiler.exe

pid process

2092 Zombie.exe
1928 _MofCompiler.exe

pid	process
2092	Zombie.exe
1928	_MofCompiler.exe

Drops file in System32 directory 2 IoCs

Processes:

33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\icudtl.dat.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe

description	pid	process	target process
PID 2308 wrote to memory of 2092	2308	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe	Zombie.exe
PID 2308 wrote to memory of 2092	2308	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe	Zombie.exe
PID 2308 wrote to memory of 2092	2308	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe	Zombie.exe
PID 2308 wrote to memory of 1928	2308	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe	_MofCompiler.exe
PID 2308 wrote to memory of 1928	2308	33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe	_MofCompiler.exe

C:\Users\Admin\AppData\Local\Temp\33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\33b87797901292f6247a6a84a762c44baecb769ca4bee021bc4f36ade93a5bfb_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
"_MofCompiler.exe"
2⤵
- Executes dropped EXE
PID:1928

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3940,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
1⤵
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe
Filesize
37KB

MD5
c8951139aadb89fc2114bf5e5c575107

SHA1
eb0f40a16ecbc48d6b2d1a2a6ed3ebbc75a99b52

SHA256
f022e32b9299add0f8368939b6f86164060a24a32832565486ec7be2b1f560f9

SHA512
883edbb6f29bb1651ca9e4338b1ead70e060279316d7fce7ebf5128844fc2a9657f72ac4bef7fbc2f9ed50f4d69f9c4c5755e96a118a70896dc0634e9a201dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
Filesize
21KB

MD5
0fe6e0e01318f2a27ece0176423ea4f8

SHA1
71cf6aaa4a88a2e892ce113fe35518441a58a97d

SHA256
36217b7c4ac6aabc74a7f9d0d8da2002f5909d1d6dcb663c9cb1ec2c02a387b3

SHA512
56be67fcf76f46a171c0ebcaa988e1e20cdba5fa91871e076b424b0b9bdd21219a19ca70c85314e5a79c1f878b7f68d7e51596b49536296e41ded5846158ac9b

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
37KB

MD5
e9950d542a10bdd1c84b5039f7acac07

SHA1
0032e7b5fd754df9029c33ce789853ae0aead09d

SHA256
1d4f69a1c526e0fa0c4e94008dc82a732b9d9cbe88ea27d5dc67dbb4f2202452

SHA512
edb29fa48a3ac889cf8989cf4ee4c1326b64792a4e7412b0aaf49eb06d7c1ef0cb5c84b69c24133a5bbe821f2a05ca8f77360f475fbcd38c1c8e4b900fc8b5b9

Download Submit
memory/1928-14-0x000001C59E4A0000-0x000001C59E4AA000-memory.dmp

Filesize
40KB

Download
memory/1928-13-0x00007FFAFC2D3000-0x00007FFAFC2D5000-memory.dmp

Filesize
8KB

Download