Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:43
Behavioral task
behavioral1
Sample
4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe
- Size 194KB
- Sample240603-s59mqsbc31
- SHA256 fd36e37b6cfd8db90bf598a500da2e82967d59d431e2504764d3deb089c57e18
- MD5 4abffd917d344eeaafcc1f3d27cdf5c0
- SHA1 a9c53b6bf93d44f7ed92cb4251cc5b437458e97e
- SHA512 7a91197b688145c2d17cb953954ff1180554127574b552ba340aff9d3a9ccd1abd0be18db8ab70fae53ead80c5e15cf6624cac36cb102d4b2ef2c20890c6d1aa
- SSDEEP 3072:fnyiQSo1EZGtKgZGtK/PgtU1wAIuZAIu+rx:KiQSo1EZGtKgZGtK/CAIuZAIuQ
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1512-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0007000000023305-2.dat upx behavioral2/files/0x00080000000229db-6.dat upx behavioral2/memory/1512-1608-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp 4abffd917d344eeaafcc1f3d27cdf5c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 195KB
- SHA256 bbd98dba6c84d0e7c4462b91b1171bce759fa6360d2189f3c12ae5c9ca03ca8d
- MD5 7ae161846ea59ebcd4268bec1fbfa790
- SHA1 32a6c33808f050f4e40f2bdd22e9d1bddc795bdc
- SHA512 f2173e835b6a604c4f30a5df23daab7e42526c205d34adbf04e657e2ce309ff08e472f9fd2e43ee1c472bc9b8707374505e9429a1a58c16dbb5619f902df4a82
- SSDEEP 3072:fnyiQSo1EZGtKgZGtK/PgtU1wAIuZAIu+rx:KiQSo1EZGtKgZGtK/CAIuZAIuw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 293KB
- SHA256 c1876f67330b8cefae680707668dca83f6ac10a2116c55f19521e190c1ee5a59
- MD5 54f28e4aada578764d4767d03aba9375
- SHA1 01c3113fd20754b940ad9611071fc4fb56ef5ed9
- SHA512 ac98eaebe1813dfc533e351e08b3a1a701185999ffe3a5faeb2d1e801387514357d8bc1677c1a9e43edcfbbfb94b3cb4557e8db999012cc4e1c800971f382793
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIuMIjNDv0bNXkbvLa:VQtyZGtKgZGtK/CAIuZAIuMIZGNXkbvW
- MD5 SHA1 SHA512 SSDEEP