Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:08
Behavioral task
behavioral1
Sample
1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
-
Size
193KB
-
MD5
1e9bf67d8df7f90a5a86cfacd6baf7f0
-
SHA1
f501398d9b80873c27f5dccac76f955d281fce33
-
SHA256
482222884d0ed905ca86a8229d34ac78a8852a46b252a0206ca3b88d7fcc4ab3
-
SHA512
3f2dc7fe36d7bff9ab515beeb16bbdd27b4a9847d398f395a1fface7a3b5de7a4d8427a8d0a133b38ea3d459e635c4330798a767cc0210d243a836661ede06a9
-
SSDEEP
3072:fnymCAIuZAIuYSMjoqtMHfhfag632T/IkKhzX6j:KmCAIuZAIuDMVtM/sgGqIkKhe
Malware Config
Signatures
-
Renames multiple (4717) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4320-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023405-2.dat upx behavioral2/files/0x000800000002294e-6.dat upx behavioral2/memory/4320-1648-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp 1e9bf67d8df7f90a5a86cfacd6baf7f0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5cf23ddb27ca023889521ad00171cbe67
SHA17a0ee4d7b5834516deb9e6f4c721f5a951669df0
SHA2560ab5b9e9871b80c95cc28c7d999fc0819a2c7f54dec80c26677b0b845ae87487
SHA512bbab646f0bbc757a862a5245eddfc0776d52f53b2d123fa45163a4bc35573a46f6482a9396d9470c28fff49df279c586486c2894d09a8f88e246a27ef202b99e
-
Filesize
292KB
MD5493b682449e5fd21a62cce5a04d5e78b
SHA136d43754eef7f52379b4baf8852ab60e8aa74e11
SHA256b6b7e705040fb84f607bf174a615331a38c62b3e1027f95fe4a421133d15f4c1
SHA512d3383d10a22bc0450d8dab6dd6c4bf2c572c95bbb3c87e79415eab08558137ea4f11d0be1704a48819da9add99649aeb75b268dc779d8c460d98bc267188e3dd