Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:08
Behavioral task
behavioral1
Sample
1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
-
Size
193KB
-
MD5
1e9bf67d8df7f90a5a86cfacd6baf7f0
-
SHA1
f501398d9b80873c27f5dccac76f955d281fce33
-
SHA256
482222884d0ed905ca86a8229d34ac78a8852a46b252a0206ca3b88d7fcc4ab3
-
SHA512
3f2dc7fe36d7bff9ab515beeb16bbdd27b4a9847d398f395a1fface7a3b5de7a4d8427a8d0a133b38ea3d459e635c4330798a767cc0210d243a836661ede06a9
-
SSDEEP
3072:fnymCAIuZAIuYSMjoqtMHfhfag632T/IkKhzX6j:KmCAIuZAIuDMVtM/sgGqIkKhe
Malware Config
Signatures
-
Renames multiple (3421) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/308-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000012272-2.dat upx behavioral1/files/0x00020000000104db-6.dat upx behavioral1/memory/308-642-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\Filters.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\rtstreamsink.ax.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5b9852c45a7e517937836ff735cd2a41d
SHA14688095475a49e92a8253e142431781d29b68c60
SHA2561c8dea38982ee07d0988b3e568d25f018ba9d2f8adb049ad56de3ee5b514bc21
SHA512647eb50baa88d640983c506020cf0ce831d8119b9f5e79172c352c891f74c01f0e2bb6e10c9e5a3964b81a2a637620da57a6ffc8f1eae873bf09ce943ce35eb3
-
Filesize
202KB
MD56fa3faaf72b0f36e3aa171f17b4806ab
SHA19bc0d2a00f474f2833d4c62d1b66644e52d3d081
SHA256d4349ab2b9b2a9fcf66b80a419eb83990bc57c3da66fb3dd25a9af1d28740e6f
SHA51234a13451fe14e825a2001e9c4312418cba8e52142d2687758518f0bd8219880aed23d011fcc34177497be8f390cf5fa6ada628aa2921eef972a9e5c584283cd9