Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 20:45
Behavioral task
behavioral1
Sample
85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
-
Size
41KB
-
MD5
85255f8ab5dd49e3c01fd09fd8ab63f0
-
SHA1
4ffd2b35715f51059424f4cd3819c4054c3ba8d3
-
SHA256
95dd78c262cc4b96bfb7f31cac481d615140fcc108f404406ea1d251bdeaabf4
-
SHA512
ad9ef7c3b4699f6f4f80bc9eee2617a8c5a5f6c9a116bad918578927dd9f48acd2bdd0bfd801d735d3f508ae62bdfc4b32af012e4d648d574f777f58d886eb79
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFv:CTWn1++PJHJXA/OsIZfzc3/Q8v
Malware Config
Signatures
-
Renames multiple (5179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/3344-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/3344-1116-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\external_extensions.json.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmpFilesize
41KB
MD5861e3ce18560d29ef63b9c155d3d503e
SHA1001b4ce7b165ef0d4012515e691a1478d8fbef82
SHA2567848d3a8824afba310bc05cf9ad9546040df99d4a77291e79495e4642aea3227
SHA51268c7cc8ca4747934da38b66968c90a96cd1e976ee60e1d1829fbd8c53284128f2cf9a304bbb62dbccdc25ec27cd18e1a60feec3726b5ac6294d24a55943a1f29
-
C:\Program Files\7-Zip\7-zip.dll.tmpFilesize
140KB
MD58aa519330b9b49542b094385d9661670
SHA1031bfa65ceea2431c8a5053247f9d03fc36ae1f8
SHA256a00e9f819791ae7fe584977c4dd35e40c06e62ff691e7647fa9d14f7634ecb70
SHA51247902a876e757985eb24e69df6823784edd2ce1b00f83eb0fcf1b4652389d967b87707fd01278c0cc56d9969588a8fb4346a7c11defbcbae3f73cfbb7e604a42
-
memory/3344-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3344-1116-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB