Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 14:15
Behavioral task
behavioral1
Sample
a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe
-
Size
47KB
-
MD5
a0a7fb03464b598c32a424a41720c6c0
-
SHA1
f4872e7a3ef4f374ab6e20cbd4031642feafb26e
-
SHA256
5aa2fab1805273952bc3f449f80f42fd7a30ea604d8c97f371cb84fd1a559294
-
SHA512
b30e6506f8bf501eb63c325be668e8783802f34c867811241ef32ebd1eacfed73a6365ea2197309fea0d005f8e6a2b7655fc8e57412d4ca1a4cb0941b11dc6bb
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFaL:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe/
Malware Config
Signatures
-
Renames multiple (1901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000f00000002325c-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/3452-296-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-memory-l1-1-0.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TextWriterTraceListener.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Aero.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ReachFramework.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Watcher.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationCore.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Xaml.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Aero2.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.VisualC.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationProvider.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationCore.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.ReaderWriter.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClientSideProviders.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsBase.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationFramework.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\Microsoft.VisualBasic.Forms.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.EventBasedAsync.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Xaml.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsFormsIntegration.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Design.resources.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0a7fb03464b598c32a424a41720c6c0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:3452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:3544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD522297f9a4347688130ebb6aef01c0399
SHA176a6a56ee3088bb4b1ce9c5e4824228a48a54d30
SHA256c2912ab2337374ca472505165d414878eef7086647f957cefe7287fb2510ea68
SHA51252ea241348865b9f42ee2c85af320fbcee2ae5c498f42890342092ca69e60a40b505de8600cd4defb7c64086694aeb9bd5b13711aa71b2dd843a450fffde24ee
-
Filesize
47KB
MD5356c5420674b4e0dbbdc9292418e0d4a
SHA13a937bd4b5feedb412e3e136def8bcad99dcd714
SHA2568ec874e76c239b00f38d2658eee19f030d05222042dd479b93b6b96b166dddbc
SHA512f1862dedc988e7fa9adc4087a32da420cd0d4529235e77241f795c9ab050dae99ad8079ddb4b76cc02e5f635f7a9d8287b9dd04a662afe57797f3e384a1fd523