Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 15:10
Behavioral task
behavioral1
Sample
6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe
- Size 266KB
- Sample240607-sj3bjaac3t
- SHA256 f45cb9a14edf8bb5f6bca435a629ea4edd8c9a96eb872f1074ea4bcb37116638
- MD5 6563e0c1d59af749857e2c181cfef9b0
- SHA1 078e528a78a5b92c1b283cea77772e27b089e4d9
- SHA512 007c051c40c4eaedc821b9b351f7603370023414981bed82e4df63076a097ff9ff785b664cfcf4d9da0455a4d142a2eae8d87e8183e2f636a04cfa280c490598
- SSDEEP 3072:fnymCAIuZAIuYSMjoqtMHfhflixi5fAIuZAIuYSMjoqtMHfhflixiu:KmCAIuZAIuDMVtM/3fAIuZAIuDMVtM/8
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4816-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002328e-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/4816-1604-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp 6563e0c1d59af749857e2c181cfef9b0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 266KB
- SHA256 b84968f623687a8cb5d5c9015ef94950b651311ac24e6f0c14b1858d9117b1bb
- MD5 8a60e36d34a3c6ffa1a534c14ef91483
- SHA1 ac956b4b985af2a818b47b8b29666debe99e2c2f
- SHA512 91d53a4bb1597f24f740ab84dd630b1461acaa29e8b0c4e2f4bae21e71b867f3658a6d32b4f4578682cd0eefa5262cbc4cdc1ff9a9bf1edc077d7d35ee61cd9d
- SSDEEP 3072:fnymCAIuZAIuYSMjoqtMHfhflixi5fAIuZAIuYSMjoqtMHfhflixiV:KmCAIuZAIuDMVtM/3fAIuZAIuDMVtM/f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 365KB
- SHA256 6713a32b095ce99335124f8190ed478235380096812442e362b8168f37a84f07
- MD5 c38f3e21428d71fb9b72491f85baa550
- SHA1 33cb75568b2a39d952c7f5c1cd5581943c7b0da5
- SHA512 a9a58fe7a7efa130a8ac3d0a513f31368b91a34422b88bcec6c7231c694919f97ebfc560a43f67fd71fdc55dc0689007d026171d6efd70f036be0c4eec91340f
- SSDEEP 6144:KmCAIuZAIuDMVtM/3fAIuZAIuDMVtM/kIjNDv0bNXkbvLA:IAIuZAIuOyAIuZAIuOBIZGNXkbvLA
- MD5 SHA1 SHA512 SSDEEP