Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 02:38
Static task
static1
Behavioral task
behavioral1
Sample
847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
847031b6f7f1732382db525034a204e0
-
SHA1
d4e644c946fb197e9bcc7244c7c988cfce9d7a9f
-
SHA256
2e94be53c921576a9922815e5d206b92554c1cd7af9b59b65b3ae081b53520f1
-
SHA512
672d4926abef8097c1aff717c40630045819de012a091717856bf489b9e916c735eafcf41b89a909ca4e2cd4a02317c35a14c010bc398cdbba084b458c4c8f01
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhW:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsf
Malware Config
Signatures
-
Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\LoanAmortization.xltx.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOS.TTF.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\ExitWatch.001.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp 847031b6f7f1732382db525034a204e0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD551ef2eaef08ec9fbf7da7851f27ef7cb
SHA11734cf9876625a5cfa374e22a4ac64cd5f0b25b7
SHA256ca7324ebabb447c2e94c0a5fc501c17d4fcc00ddad109ce03b7f14cafd33c105
SHA512cb608a3fec44cb945ff75333eafb9e00b5702ecb53fe0c052b4e19c5bf83ebe0d7b1011fad930518acaa9c844c6f879e4cfa44207de2bb9f16202160ce77a614
-
Filesize
170KB
MD518b5ac681d9ba2536277518d4b286a6d
SHA11e9111e6d2b21c5271b92827b19bcb8230e87560
SHA256c147d2cfef0a4184e03d5259ec6cc267d7e9a037712688d434850e0dafd0bc5a
SHA51218aea2c6b10bf948116e5b7b3ebdfce7da042b63b80fe4c01049d88444457864c8191de70b51c7d6d71a82c5541aa713ec7e0f24d30e7c6f6dbd630fc8d37d89