Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 09:55
Behavioral task
behavioral1
Sample
f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe
-
Size
56KB
-
MD5
f4ee81ad2e8812a13f0cefeeeef145c0
-
SHA1
396e104e5749afcade3f421e5156bc388ce1a5fa
-
SHA256
170aaf69a8ee722414f987c9ee8903c416d6d41dbf21ae1dc9ab3e95ebdfd10d
-
SHA512
67c5b8009f4c43cd4bcfd0ea2dd597671e3b2f961eee70c00f60ed95973a6ffda5c432903d7283787d76e97cb086a3fc85687171d431482fbfcb74ae7d812dfd
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFF2:CTWn1++PJHJXA/OsIZfzc3/Q8yiXZw
Malware Config
Signatures
-
Renames multiple (4067) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b00000001226d-2.dat upx behavioral1/files/0x00020000000104db-6.dat upx behavioral1/memory/1716-86-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_left.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\FindShow.jpeg.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\jce.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FDATE.DLL.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\main_background.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp f4ee81ad2e8812a13f0cefeeeef145c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5d39a380645a705a04dfc5a8a2e2bd269
SHA17e27b64beca35d7d8f430c71da71dc0946daee3e
SHA256a57a46bbafd18b8a6a4472374adc5461bc6b671d5ae1de54420de01258e6a196
SHA512e4b1bf796c59d7a990ae0bb6692495b25fd7d4ac5fe0dde349e142fb6036cbd11be5438757204794b5a6833f9a2c8f80a3b7a30378979893365e382183eea0b0
-
Filesize
65KB
MD508d1b0668e910451a939291788a313d9
SHA17c76fc2749f3c21c6cf50c2fd96fdb2f0f6f463e
SHA256c1f2bab50721db27c2f6244699b8f2c6417ca05064ccb3e7bb6499876384bf8d
SHA512ad00d877b43ba1b2c66af77e9ffd9922386188c3b964990e40e981490da197f1718fc384b3eabdc0acb21599ada17f7cfccfc82b7039afeaa5eaa9b02c409474