Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 03:24
Behavioral task
behavioral1
Sample
87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe
-
Size
227KB
-
MD5
87cf19364e1beb4c56e55433685094f0
-
SHA1
acc9075cd32ec40eaea75cb7541190553dd13976
-
SHA256
46f36c8515b245e355c5220e1c9f3c5a76b3326157db78881ee745fd367c6aa9
-
SHA512
ddaa0a8c2ed6b8a5f880c48b5b4567389d1dc49349528b1a4fe53e26b8117203dc38ec4a758c27f7736cc20d96a624592a86b0503ac3b699f7ee9ac062917c79
-
SSDEEP
3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuYch93g+gfFpsJOfFpsJE:JiQSo1EZGtKgZGtK/CAIuZAIuH3Q
Malware Config
Signatures
-
Renames multiple (4720) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1400-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/1400-1670-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\it.pak.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoDev.png.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 87cf19364e1beb4c56e55433685094f0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5c755b51c8debfef28bf626803c390fe8
SHA1dc27cde957e97847be73f6f9ce9babba40cad74d
SHA256f71e58176eabf2130832cf9c4b923afe820d1c1981d20b20a0aefcfb3012a5f1
SHA512a1fdef801bf496516133f675e1f42aa23451cf5fcca80189aa2d5852982b3279a9b45e7946bb0d8832b57718ae44ad69c45ead06d9b2a906a4689b996fdfd2be
-
Filesize
326KB
MD50a5d52911e411abd308c46a9214e596b
SHA1f877003ce09c8c9475499b843e5e3411289740dd
SHA256ddbe278ee74e6c2751869f5df53fd86c7580b82eced7cafaf69da934d0f54a22
SHA512158d495cbc79f2b7d72e8ec8e757253282723721f1640ad0e5f271e1be7a822fd974a29d01892dcd85b3520adea09d076b10a4c4f4410a37c0f9aee8b14f5a74