Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe
- Size 70KB
- Sample240511-q146caac5t
- SHA256 83a9fcf21ce7842ccab8d6f5925dca879e045d8fe596e35df25081ef2a759b0d
- MD5 0a2bda61ca9dceebb70de317d6f2c8d0
- SHA1 1189c11d2342c1a8a247b6af359dddd82a3be67c
- SHA512 d2ed6af6f37bb235c7f3e6b9df1e7db651254d7f89c7cd1353947d4d195270766d678212cbff633fe80583788e870cf08f3f53ee16159701c0d6bbdf9b315f93
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJX66Fl3Cd:W7ZDpApYbWjIlE77ufL2e+e16al3Cd
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ar.pak.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 0a2bda61ca9dceebb70de317d6f2c8d0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 70KB
- SHA256 a9a4a0363f8e7aa00db7bf151dc7f86301691a9fe9b666495d28c34a61b51017
- MD5 9497ce88cd703149b3c00dcd1c312008
- SHA1 a2c721def4d8b45cdc8013a7ccb61505f264383f
- SHA512 e9f9e7bb2e9cd140c877d0ef824f7c628314b162b4a41c28336cbbdf90c66910636b692ac645857e87c47c351070895996e5cde8dddc867f3a51fbe2e4d306f4
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJX66Fl3CJ:W7ZDpApYbWjIlE77ufL2e+e16al3CJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 169KB
- SHA256 dc0db549f4eabe0fc0709d72453c7ff3b33c5918d6c63cffba2e9846da90fe8b
- MD5 5e88e07a0407cb66e1845dfaefde94ff
- SHA1 f1eb19ce570d9da7700afdf11e9db39176a7280d
- SHA512 47742bbb6d27a8a281649bca31aefd1f3c1dda4de35efb9e4d3066632d6bbdfcdbffc10e5e7d87fe0cc6644673e6eb58020d784467f08a5830c83d304f8c2e77
- SSDEEP 3072:6DWpwE7oL2e+e/lFWHIjN3tj6qnv0b2UrXkbvLC:dN/e+ewIjNDv0bNXkbvLC
- MD5 SHA1 SHA512 SSDEEP