Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe
-
Size
46KB
-
MD5
a42c8706e8553d5325a74c0f14d07640
-
SHA1
eed0e3482967f689960a33e841c67ac3494be85c
-
SHA256
a90a763b30b7ee319f7ec8448b23ef09fd97b303cb6cd49a28d966dde4c0ac59
-
SHA512
6a064c9bdd735485cdd2981335ef87c1ba8d924c22b2e94b9d62efb2eb105c95defddd1cd0751417568b9a256d69b0995ff5b541782432d544bd8889c0bee4f3
-
SSDEEP
768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1Mse:W7ZNLpApCZrt8PWGoPWGZ
Malware Config
Signatures
-
Renames multiple (5204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\LockSwitch.easmx.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CENTURY.TTF.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\libGLESv2.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriLI.ttf.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5a1ac6e601bbefc533b1b09d51103135e
SHA1136804f5e2b61f73b5ac983673fb550a2ce754e7
SHA25634d6dd4ddf9306ad0cf4738c54045102dcd5ae80dfc08506dda2c92970e1877e
SHA512a6369025790b206e085b2cd04fa436cbe565de5e1846e05b7d6001a19bcb0fd8ee77656902266bcc4ac5d47a25e414e43b6f58da240aedc1dec12215a555f7ee
-
Filesize
145KB
MD5c8714013b3f4bea5876561c1185d3c74
SHA1edb6280c4a2f97d7b507857a92e23d9eb6d57c0b
SHA256a3d4204a2aa12ab39a9f73a2b7534c9e6387b4040fe65fb0488cefeb960b80a1
SHA5128d2ed9df5664273529ab921b52dc566f06e1779ab45afef4930b3889fe4426c3445f939357273c5c2c7f73f8434c26d3a42f9c16c67c62f02a5a2f7451458d3f