Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 01:56
Behavioral task
behavioral1
Sample
5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe
- Size 51KB
- Sample240530-cc4m1sbd53
- SHA256 9aa49c6a2f2b70996c118b57373c030e63c60a49f3379a3b3d0521e525af728f
- MD5 5f89edccc0e26d0c43500fe753feb2a0
- SHA1 8f4442bc5b58c8d96b16826f190c86a8633661c6
- SHA512 86c5039004237577f88c7d1e854a57b65506980caeae5841eb6686bba884735bcd818f8b1eece833d6369e80aceac8e551f509596347980e464e88a7e3734a79
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFr:CTWn1++PJHJXA/OsIZfzc3/Q8yiH
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5114) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0006000000023278-2.dat upx behavioral2/files/0x0009000000022975-6.dat upx behavioral2/memory/2548-1110-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\vk_swiftshader_icd.json.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 5f89edccc0e26d0c43500fe753feb2a0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
- Size 51KB
- SHA256 135242251f88234f17f2c115ce79d909d801196abb810f4a2397d8111656d8c8
- MD5 42fd26ea8e00380d84db8e7d19d60cff
- SHA1 05429973f4d318da670a46ed0e6d0ee334032f0f
- SHA512 3877dd72b34d8f4ee31b3ca89e7f0b84dd316776a866302836f12670edb60741adf266413d1d186311c05dbd1734dc420ba44a0c0fd24999009328ed4bad86b2
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFA:CTWn1++PJHJXA/OsIZfzc3/Q8yic
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 150KB
- SHA256 3743ae91143079573f720c414da6a22b81a4e4aca9b49ddcfd7838bccf7fbc9a
- MD5 f4448f606464fd25f36e4f2b70beee70
- SHA1 3dea83a8ef20227cb196a9cc822e9ae96641d1a0
- SHA512 510643bc9e7ad845ad2acff411743aee8fe8051ad1603bd6e8a84e34ffa60d96d18ef8913b94b730bfbee6107a7897ba0817f7df2a39dfdfd19eeeeac69cb3f8
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8yiP4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0D:KQSotWHIjN3tj6qnv0b2UrXkbvLc
- MD5 SHA1 SHA512 SSDEEP