Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:56
Behavioral task
behavioral1
Sample
a5995ddecb303156494353c39d423480_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5995ddecb303156494353c39d423480_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target a5995ddecb303156494353c39d423480_NeikiAnalytics.exe
- Size 83KB
- Sample240603-q8mw2aaa92
- SHA256 8bca4b211f0b5fd9b34416ed1ac5d25682f6d9e1dfc0428d28012affbc13bdc2
- MD5 a5995ddecb303156494353c39d423480
- SHA1 0bbf9c7f0d9d5ced55bdf23098cd1ea6c1e3870b
- SHA512 3d810b55b7ba6ad527fe2e60417dd7d28a35deab22441f7505179be726e2d18666494a621f1643f789e51d1539a36f3ad81287d82cef6d793dee81d267d03868
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiDGc:fnyiQSo0
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3700-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023430-2.dat upx behavioral2/files/0x000800000002295a-6.dat upx behavioral2/memory/3700-1786-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp a5995ddecb303156494353c39d423480_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
- Size 83KB
- SHA256 27b659c5ac4de4f1e8ad73ceb2738be3add5d930130eba8115b8bc6f57a32ce6
- MD5 fe0154dd1bf8503d3aa1de5600a2870e
- SHA1 ad835f2da5961dde03ef38814497740d95c80ba6
- SHA512 f074775c8555984d0f286e9354d03b0bcb2f2b554858a0b31986c857a4bab4bc739ca1e8a211f1537e266da15fb5bd734414ca4be9c06c13b0671352f86f2f6d
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiDGc:fnyiQSoE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 182KB
- SHA256 211929a13bed100a6c415b101c58b2f27c6fbe6b06c6304304e7145842bbe399
- MD5 df1eefa6a98df589f73781b937cd218a
- SHA1 04791aa1fe8db2a5f854e5f46aa1146b0b17f725
- SHA512 034db4e39f3e645fa424e53b07140c8d51c2fdb0bb625696c272758ae2aabb0b60582ff6eb1fadfe4de8371be649f924447894aef02fdc15114264a47bb7dd6f
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiDGa4pWHlPEXZzjUq3th5f6utM5vLNN:fnyiQSoBWHIjN3tj6qnv0b2UrXkbvLe
- MD5 SHA1 SHA512 SSDEEP