Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 02:33
Behavioral task
behavioral1
Sample
842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe
-
Size
249KB
-
MD5
842b0b42081097e5c95fc08710ee8e20
-
SHA1
1c5f93ea0b5d1e8944f7c813d2388b7a96745320
-
SHA256
0176e4ea126a0d0c12358b09de279561c826461dec0dcba8974c43a81ba0ab5a
-
SHA512
f9da00358efad684112de6643034fa251ee2dbda7435bb9b9d1ee0d65d89e81387a2ad9239ad8435cf9ad8c90f23090b1b7f74890c42370ba7083308dfa5f994
-
SSDEEP
6144:KmCAIuZAIuDMVtM/sg8fAIuZAIuDMVtM/sgY:IAIuZAIuOBgOAIuZAIuOBgY
Malware Config
Signatures
-
Renames multiple (4673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/456-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023404-2.dat upx behavioral2/files/0x0009000000022975-6.dat upx behavioral2/memory/456-1600-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp 842b0b42081097e5c95fc08710ee8e20_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5a33391fed91c742b2c3bad7d82d910d8
SHA194b7e1d88cf63cb6a42638bdba733fbe90ad14fe
SHA25656ade64479e8c318649e681759346241386df3738c1c07a890990aab2c772430
SHA51264992275b842a98a51a5142a6ae4de1f59b4dae5c0b8660dfc27359302d21ee3f4892de48b7d9c49846f9569acbcc5212c48458dfa521168a2fe88936ebcd812
-
Filesize
348KB
MD5731bf1fd39b8a3196899eccdb2ee60fe
SHA18c3fcb7442cdb1eb6a29f9337a77ce969b95f2f3
SHA256443d97d8b80066a57650626c8ab9f4271f7f0b6ed362f079015c68cb1df342a2
SHA512a0ae3449fb78733d2b1a211a291ce7061851fbfdc94045b156055462cafc68ab89bb20c61c8320352ee5ae608cab96f20959af6e6338b7258597ba72f8005d43