e8eb83f3e542a604c9f0f34cd1911b3215b157c4174bca9203f9bbd3f9f377cd

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
Size 82KB
Sample240601-11ewkaha48
SHA256 e8eb83f3e542a604c9f0f34cd1911b3215b157c4174bca9203f9bbd3f9f377cd
MD5 00b9430d235c6b76de006259fd5de480
SHA1 aee20339e0957b159cdae64eed74981927c2a3f6
SHA512 f2431ee929b34b68d8acd31dd9e1883b87fa0432ae65124d1d1a8bf7cc6eb10af0461ed32bc4171cfbb72d93de2ba64084bb9ad65fe09287e1e948cb1b22a7e7
SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t2rt303hHUsI0Da0D0:6e7WpP9oVLQthbYY9oVLQthbUrt7t2rJ
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1834) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Primitives.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Primitives.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.DataSetExtensions.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Primitives.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\ReachFramework.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationFramework.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Cng.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TraceSource.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Intrinsics.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\AddSync.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationFramework.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\.version.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.DispatchProxy.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationFramework.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationFramework.resources.dll.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00b9430d235c6b76de006259fd5de480_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 82KB
SHA256 f37fe6e5dd82b51cab7ca9ec9ef14e498420c083c8a26876456547302e67d7e4
MD5 3423a69142cb9daed4e948018ffbb38f
SHA1 9988555b22dc1de6aba93d2f6a4be83be154365e
SHA512 4f9cbe12148453707136ba764d52ee177e453de73a99e090081bae0cf3e11a8b748fc35da1fe8f2919e224a5ba4b4c76e5efae22803bddce49d0e176e399d53f
SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t2rt303hHUsI0Da0D1:6e7WpP9oVLQthbYY9oVLQthbUrt7t2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 82KB
SHA256 e2a5d94b298ced9e8896d0c09414f67a4a8d830c621953176056ec57f3e5be13
MD5 c1132a1937cd2d9ff81e6ca7196637ea
SHA1 789cd2f9989105aae5d7eb03afe89c5e56ebc181
SHA512 53be320c59f4baebd883a985f0d3331e48ccd4d6a204296b7d429b7e248e5459d5c5ada75a2ab59a91147cf5e540e7d07b0f009143b6ae742ed03dbbd7e8666a
SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t2rt303hHUsI0Da0D2:6e7WpP9oVLQthbYY9oVLQthbUrt7t2rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads