Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 20:24
Behavioral task
behavioral1
Sample
0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
-
Size
41KB
-
MD5
0177bf1e7f4efce8d5f09d6b465ecde0
-
SHA1
1d1fe4570ce54180dcdcbc38cb3c95712ec386fd
-
SHA256
290acdbca4c4685524de159b1c8dcf3839d03362ea95d778f0e2fb29e2e99217
-
SHA512
0896e3d01fec516df3c789b4afb1d6b7b925f8071200d90f9d337a9b84db910cded647e989c627c944961e840da9618a5205aeb870cb98bfeb6d614969d35ba5
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2o:CTWn1++PJHJXA/OsIZfzc3/Qo
Malware Config
Signatures
-
Renames multiple (3736) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/788-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a000000012286-2.dat upx behavioral1/files/0x00020000000106a2-6.dat upx behavioral1/memory/788-74-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\logging.properties.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\wmpshare.exe.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\MpRTP.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\PhotoBase.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD517796e673ee46bac14394045d7309d53
SHA1e431cd0fdce177ca56ca6480fd6e465ca6e6194b
SHA2569cec224efb2596b4ab6eb813d0cd172878a7094181f8a159477399185652c64c
SHA512abc9cfb67c7ef581acb5304006bdfc8715e30070d9f125aedec6624e1c0ef994e727a11611f0232c558ca4872c4656c19590f0b4023ca6de7bac3ea68f1c53e1
-
Filesize
50KB
MD543742567719e2817c16f40ec9556ec33
SHA12481f5061d1629c4e8c25376b23ff67526d8c338
SHA256c4830e194235d768cf91dca0eb48f9e44b024c96f50abef4af026941cc5916a5
SHA5125d9f5ae089447aee5efaebb37fe864eaa953d23b0c3033091132fd7918e68398a24d7f69837bbe8f472dbad85f65e2aa7a4945c01acbc220045b5f0556fd4e85