Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe
-
Size
45KB
-
MD5
8d214a7b06ee01e32323bd076aa72cb0
-
SHA1
70294a00386af3a6d10f341ba91117b2e4c91945
-
SHA256
65014a87a5afd29fc8e2a175dfb9dda9375ecbb7eee6eb55e32b20518f55127b
-
SHA512
6e78c01c923422a3642446786af8ef465a83ba7c02293f967f3fc13e00e78af4cf87448f1ec5f08e6fbade6f267abc9b71a3900ab1455916fcba48291e40dbfc
-
SSDEEP
384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKriCZbQmJKUCZbQmJKV:W7BlpppARFbhWJoQmJKbQmJKV
Malware Config
Signatures
-
Renames multiple (1725) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationFramework.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.Json.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsFormsIntegration.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Input.Manipulations.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.Primitives.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Primitives.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Primitives.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationFramework.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationTypes.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.Client.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsBase.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationProvider.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.FileSystem.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClient.resources.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:2828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3536 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵PID:1876
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5bbba0f9ba7202165af01830ad7158323
SHA166bfb1e8b2c7e9df8b7babe889718d89bcad8742
SHA256c6b99f88200b77fe91f5028e81b3faddfcc112ba45b0f532f5424e3bacd7c75c
SHA5122ad437ddd0912ffc8e2f53af0a034e4129d5d53972484d9529c1f39234055f3efae137b9964622609c99832d3816bafa95194106275ddf79f1d963d4ddef9009
-
Filesize
45KB
MD58e65e6fc09ee3e4c9f60afc76ddc0be4
SHA1dbb963fdb47b7806d36057521255d10f6ed4e45a
SHA2560c11bf3ece6556643691816c3aa8d03890efe18f92910ecb34eba37ddc2a2d48
SHA512c74614b285466df4401bc6566403de0fe1f0d13178d0d26b8360a1541628ad44513ea09e8e70f5424178989e83b65e3dfc5f94a76ee6b65b0ad8bb534810361e