Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 02:21
Behavioral task
behavioral1
Sample
8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe
-
Size
48KB
-
MD5
8368188a13878d819eecde96bec0b360
-
SHA1
68214f35bc7a4d9140f46f90751f46f83d3d940d
-
SHA256
e69807b0ed6836e36d5ec79ee3235db9c2a2cabbec9a6e48f6a771ea78162fea
-
SHA512
38b911fc4bab944317d05663ede0d6107cea8c75ad6a0edb5fd294bad1414ad76863900928c9fb062b4044c3e892fc4a44a58d3cdf6294da272b1d316df54127
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAF94:CTWn1++PJHJXA/OsIZfzc3/Q8q
Malware Config
Signatures
-
Renames multiple (3497) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3008-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a00000001224e-2.dat upx behavioral1/files/0x000200000001048b-6.dat upx behavioral1/memory/3008-76-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Journal\Templates\Shorthand.jtp.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\Documentation.url.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\settings.css.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Mail\wabmig.exe.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.tmp 8368188a13878d819eecde96bec0b360_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5697b324cec7cf1b984a82956ba58a28c
SHA1c15bf2917d93aac17d703ef1d5734bf395ec6aff
SHA256ed8bfe12d3d5fea0452ba368887c181cce3bead60d0d1948081a10db4be2d9dd
SHA512ced0767422cb8f7f25d06c8723f42cd6754c7c1b59d01c790ea65973fcc24b0709e6e6a1cf8f24f9c7282d1a80329e733601eea8ede21aa89dee0733d3e0db2b
-
Filesize
57KB
MD5c2e122474faf52d01904b286a1b55380
SHA1d7a19a9a61f3829b3e76df85e41222427dcdf417
SHA256693e8c4eeccd47b7045fce974eb9baf6a3a20e2614e367bbf123b69c5db741ee
SHA512bb37dca36a04432666e79ba286fcde276e18fb00276f59a122463d2ecb6d664e89793d161bfdc87e272f1d63c2e92f9864f5d53d664ef02ce6261fa670da9c2d