Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 20:24
Behavioral task
behavioral1
Sample
0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe
-
Size
70KB
-
MD5
0175ec3c769ece79d513caa040a11850
-
SHA1
315b004cfa187305081edd35043ee65d18fe820f
-
SHA256
ae5b45da6155dfb98a93a1dc31ad4c68c242a45b0eb84e5f007bfec446a5d092
-
SHA512
06b3dbbd360ce7af7b703ba39b93ced7ba4878d92a35a34e4c8bc919afcaea86b0fe7485d738c73806a6c534cd83c8be8c89fe407e5783cd7d0ff8a08e9d1a1d
-
SSDEEP
1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUs24g:+nyiQSohsUs0
Malware Config
Signatures
-
Renames multiple (1002) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2468-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023276-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/2468-298-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationProvider.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsBase.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationProvider.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationCore.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-2-0.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemData.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.HttpListener.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClientSideProviders.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationFramework.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.DiagnosticSource.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Annotations.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Controls.Ribbon.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Debug.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsFormsIntegration.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebHeaderCollection.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClient.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Primitives.resources.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\netstandard.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.dll.tmp 0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0175ec3c769ece79d513caa040a11850_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:2468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:1400
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5ae12ba0c70e417a03af2e5e0bc0b3e40
SHA1493a529bab6c8820fff14de5d5ef0361946cc8e6
SHA256a10ace6ef24003fcfc5859b7e4ea5230d5cefb2c3aa28a1a2b371ebd40c921d3
SHA512d59b5e673b9b5aa37bf2e2ef864b8ed84b9367b0e60832819d120bec591dab155d54404a217264fc7a51f0e6e3e95bca27006f2650c591b6297ea85851d5ccd5
-
Filesize
70KB
MD5da51dc8d1b75636e0bfd60da497b7205
SHA1b243207ea83ec9b305f70b1351e4eb23326ba01f
SHA2562b859ab6a863e71a6e2db39c63ef247ddd435114677b9ce09eca4a01798eb42c
SHA5129e75936380fe237d1d40e66ec6db06d2a10955403b2db4498d8c17b2e44ea5e33d8e8c1c602f784e3a779b8c4777bd98fe78e173fb8b7f83ca41025e37533aec