2404b0bf99086b6dae68fc631dd20750e182f8b5c2cb063cfa4fb071e63ed6a4

Analysis

max time kernel
153s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
Size 42KB
Sample240530-ew13cafc25
SHA256 2404b0bf99086b6dae68fc631dd20750e182f8b5c2cb063cfa4fb071e63ed6a4
MD5 64194d40f4dbfc2b7d7051ef07a82110
SHA1 d86f9d1375593cc3e686d5fcf01cf212d40981e3
SHA512 22ca7f5da5e6204b1bfffa07cefcb52db89e502f1b504e14e2e4946257f25b3895ea2b7c0523416b7f3571ef247b355aafd32a3f37c16f4880a57bfcff737986
SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGBJ0CJ0h:W7ZNLpApCZrt8PWGoPWGBJ0CJ0h
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1290) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\ReachFramework.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Buffers.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationUI.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationProvider.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.CoreLib.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Xaml.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WindowsBase.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationUI.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationCore.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clretwrc.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Primitives.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.Core.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Primitives.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationClient.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Expressions.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Controls.Ribbon.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationProvider.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TraceSource.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.Primitives.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wpfgfx_cor3.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Annotations.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationTypes.resources.dll.tmp	64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\64194d40f4dbfc2b7d7051ef07a82110_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 43KB
SHA256 befc56c44fc482d7f232f6398ca028b8b3cb3c11ef588fc1c3fdeffe917ebffc
MD5 3fe6593a9714d9a0204337fbc8aaf130
SHA1 d7721dbe0de292813555aac3b4a557bf58dd781c
SHA512 33123b336ca7dec1974415b57386258de528b03b7108035bf0a7c646868041082676bf32df44f7cccba839d59204052a2e96f2cea36c3779266e0da867d1fcaa
SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGBJ0CJ0R:W7ZNLpApCZrt8PWGoPWGBJ0CJ0R
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 42KB
SHA256 8a4e61fee30b5e8d2941d44efc20cf375994da2ba29ede99cda2b7c4396df874
MD5 c055158966b41691bb752fd372bdabed
SHA1 4aba3aa172def8ceedeb746fcdab45d3112d1797
SHA512 f2fd28860cd1cf96182637d6f126404e6b1f4ea99b83c2c6f6d449801a903069db06bd717f55e254d9ce82f42e984a0eec405db121176828c7967ae71fb6b8b8
SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGBJ0CJ0P:W7ZNLpApCZrt8PWGoPWGBJ0CJ0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads