Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 02:15
Behavioral task
behavioral1
Sample
82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe
-
Size
54KB
-
MD5
82d931fba7d3010680d070e1cf0e7650
-
SHA1
4759e0df57792c6c03294d9a5102eba498b41f44
-
SHA256
e3a5bcf409210125ff08c08fccf665980b3c6a939a117805b03f6f7f3c465ec6
-
SHA512
330fd83d50f28bf960ba65f85d9e3668c44d438e4e705f21a4b687f0e294d00693c73664745b98b7ec17ad9c4d69f8bc6288aedf4ff6a005a39ce3b0e936d152
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97nF:KQSohsUsxe+erZF
Malware Config
Signatures
-
Renames multiple (2068) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000e000000023232-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/2548-322-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClient.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.AppContext.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Intrinsics.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsBase.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Immutable.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Primitives.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClient.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.Editors.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationTypes.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Transactions.Local.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp 82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\82d931fba7d3010680d070e1cf0e7650_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:2548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3020 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:1780
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5d2c002596875e8f332b4bafebfa1465e
SHA1a86cfeb95a89c4ea3bf7b09b5e8ab76938599afd
SHA25630aef91eee37f39941d31d1ea8d350889b86ebc19b0a8c3a0cfe3aec06203987
SHA512da0eaf69ee34a056044ab3b0015842fbf48e067271c4119b5f160871df1b3cb35d31e55f20809ac1237da5c385df45c8534bd9d76cb5d698890c6323e56dc71e
-
Filesize
54KB
MD5ae8395607c4fab903b407d76e149eb09
SHA1df697e7c82979876e0dac3b2b0cc0bbae298ad9c
SHA25604f034995e36a0a51aee5c5e91d2f3ac25b93a238a124b5cb404d0bc423ca78c
SHA5120d0e8e60218e6ee28e6a5e334818701c5d5dd19662470948617f561f82d478d3926a1f70b4bb694ac6cd9d6ddf48d5ae4e31ff8abfa34bb6d505759afd1def5f