Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
8a4740a6cb2aabca6b39054ee3f457a0
-
SHA1
9d2b3c3f0d9ab32a000c047db60a5e609591f503
-
SHA256
c930fb795be1fb4f264ce24c7872a8a8afcb3b983f45f08ec7b59add0fb71d31
-
SHA512
eceeaf0620b3868bb9779e85f298abdca6efff81d40dc4b6c39189cdee1709f9d4cdd75f28a48b203b57307ecab9aebc7d0f5403b1061fecd8932e57d604194f
-
SSDEEP
1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888l:9QWpze+eO88888888888888888888884
Malware Config
Signatures
-
Renames multiple (3494) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\uninstall.log.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Mail\wabfind.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\locale.ini.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\PDIALOG.exe.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\PhotoViewer.dll.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp 8a4740a6cb2aabca6b39054ee3f457a0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5e94ec579c81ee79cc633cf796b6e61f5
SHA103b08516aa48147131f119d85fb889e7d47baf3b
SHA256831cfb6ebb318defc1aaab941b5928e00d23eb34c51c079cefc4100bb274f13d
SHA512c6e0bb7e224f113f344db140e254002f2f550b8f2db4516be101a3a91f35c2c8f51103829f13488d26f009c811c2deb0826c6485c902bef51a80e2c330e5aa0f
-
Filesize
74KB
MD54b691ac84dd372fc1161cf89ef3b4a6c
SHA1ba38a67501050a67fb4faa23d7042f3cc4b8f7ae
SHA2560726e1f9e6b6c5ae3fd00ca0a2575b3918113c1e10ac2fa63c0feac0855e67c0
SHA5127393a67d44ee73746a83af3ead3826a1b8826faa8f9a9399fa6cd51bdfb27ef9eb49b328703a3adbfb6b67ffd6519dc2055ea650da37229bdd02a33540fb8da0