Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:26
Static task
static1
Behavioral task
behavioral1
Sample
1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
1f1ec44d2869f398f73915d6141966b0
-
SHA1
494a091852b7ece13f600a246e483af2648e5887
-
SHA256
58b0c55da6454122cb072be41dc2df495cf3fbb31ff90b1d74502dfffde51d49
-
SHA512
422cd9326f3a0b7ce04767470e965028d5c27cd9a542e3e11c9a4bb531e908f15672ae77c4db7d706b13f4597e40889df168690166a0ef103ce62e253968bb75
-
SSDEEP
1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888F:9QWpze+eO8888888888888888888888o
Malware Config
Signatures
-
Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lt.pak.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 1f1ec44d2869f398f73915d6141966b0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5539ce564e0d2a53380e1889e64eba061
SHA1e48c8936134606f3454b69fabca7252ba1c4385c
SHA25639c2bf788849eabe4ecc01e31dfbaa4d8a065e040f484e6f634ab928bf6a5d56
SHA512c030a978cf921a5e00a6ac3b9411b2dd8ee9b030457ef1f8cbab5841ef1fa0177f48447e83d27a583d7f0728e93c5acfa80f33922c3575ca617787924ba035ed
-
Filesize
164KB
MD5b0cda2ec7c0e4c115f08fed5f2efa9e1
SHA191ea27984724e516f2d9cd76f3db4a42cc7cb897
SHA256bd07c950af22e9a668c55d45137afece55f31938257b8c304ec336b906ed1466
SHA5129a3de6e1b439dd9bcfc940db9767d7d45f4d1f425e5de6924bdbeff4e50bd56f0d8d7b9c1e71456f8c4420c361509236c980eb53661d2c92b3f53a7f95fa6076