Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 09:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe
-
Size
97KB
-
MD5
bef8d6ab4b5a212dd078912668f83360
-
SHA1
fc9e510bf0783d3858079b1ba0f0bee0f219ddab
-
SHA256
a02926d54c03beb36b318f1a5ca3cc7f8bbf01110aa8c9c9a98dd04464e2a0b5
-
SHA512
67932f604431fd68628c34410afcb5f5a444262d56cd207cf6ba0669086521b3ef8806021c3cf412e02453fd612360825f64ed5eb75f043813de563a8c48c2c5
-
SSDEEP
3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEjEYnEYy:tFPxPke+eIjnnny
Score
9/10
Malware Config
Signatures
-
Renames multiple (5012) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\release.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\README.txt.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp bef8d6ab4b5a212dd078912668f83360_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD588a23b4bdf334b63e0255148a4587812
SHA1c24f7a43d293223dceb2aa736f0fb2af9086ce9c
SHA256631b86e94c4f9981af93b7559c28415ab2aef2942e53a30257f188257cf34102
SHA51215cf9c6ad4377f756936ece54c25b03b6251a0aabaca70f19b3bf7af11853026e50b7b7ed9efc1ab78ea1d8dfb76673c95b3c6b4e33903cfd9aaba5a6a18a327
-
Filesize
196KB
MD53cc409b334385203db13359c6efe29fd
SHA1fe2f06541f50c78d56013c72615dbd6a103762e2
SHA25609b28189886ac576598f48bbb8e34237a1b40613110d63f19bb1612281b693af
SHA51283d1eebf2ee90fef5a94fccef0b01513c2ccbc5188e4c9ae62221e3c47261ac058fa05a841d51f10270c3e46c9cfc0d162986772e14ddcce248d5b40a71af95e