Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 20:24
Behavioral task
behavioral1
Sample
0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
-
Size
41KB
-
MD5
0177bf1e7f4efce8d5f09d6b465ecde0
-
SHA1
1d1fe4570ce54180dcdcbc38cb3c95712ec386fd
-
SHA256
290acdbca4c4685524de159b1c8dcf3839d03362ea95d778f0e2fb29e2e99217
-
SHA512
0896e3d01fec516df3c789b4afb1d6b7b925f8071200d90f9d337a9b84db910cded647e989c627c944961e840da9618a5205aeb870cb98bfeb6d614969d35ba5
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2o:CTWn1++PJHJXA/OsIZfzc3/Qo
Malware Config
Signatures
-
Renames multiple (1060) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3580-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000800000002322b-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/3580-66-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\va.txt.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Timer.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsFormsIntegration.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.ServicePoint.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TextWriterTraceListener.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XDocument.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationFramework.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Xaml.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsFormsIntegration.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.Json.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationProvider.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationUI.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.ThreadPool.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClient.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\WindowsBase.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore_amd64_amd64_8.0.23.53103.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebProxy.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Cng.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClient.resources.dll.tmp 0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0177bf1e7f4efce8d5f09d6b465ecde0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:3580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:2140
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5eb1923faaebea5b20492839814ad99d5
SHA173ad261532b66dcb32bf31d8ecd0d18cbdad7d1b
SHA2569129031e4e07485488d432cf2c2b7a6fc5a4c51b533ae972da0d135ae1df28ba
SHA51248ea34548404b5456f3d2fed94a607ce78fbcb835f3db826f03849bc2a45c47a8c8de3a8d898801e6db886b27b510f20933c53eccd12f67f8b5718cf1a56a2ca
-
Filesize
41KB
MD50d8cda956c4df40e1d7f1b8995beff99
SHA17dfdc2324c8b94260349510ef07c187d0b8d3f5f
SHA256ef6e77ac7ac01085fb0310fe2092ca0a4ea5322af9bf531008a55b2ecae91409
SHA5121681b507cacb92065fabee4fa993179e5170427a0befdb5c4e9af7f21030e2c4648d87bf0f5e380ccf8fe5f93f8d1b260d8663232f9e18337535cc72ef0f09bb