Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:39
Static task
static1
Behavioral task
behavioral1
Sample
1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe
-
Size
370KB
-
MD5
1f70216fc25d3c8a4f24c0f4378e0790
-
SHA1
68bb003c0eed892196065aa20d8bc569886c8410
-
SHA256
d69794895e7d982b09b09ce4a03d3927930a6f690a3e55d5d1d65193cd379f1f
-
SHA512
84fd26bb4e142549f795428d308be10fb82fbf23cc8862880eb4a3cb02f17416796d6f35d80a818aec88a8f7ecd7e8ae2a560a252ab392c9829fb8cf471a8e98
-
SSDEEP
6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtFVHPyvewDpgs5:3PxPir9RyiIuGcKbpaSL4vtFVHPyvewR
Malware Config
Signatures
-
Renames multiple (1004) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.AccessControl.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationProvider.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationTypes.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Input.Manipulations.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationTypes.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ReachFramework.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Claims.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.DispatchProxy.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Windows.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Queryable.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.MemoryMappedFiles.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Classic.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.CodeDom.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationProvider.resources.dll.tmp 1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f70216fc25d3c8a4f24c0f4378e0790_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:5076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:4244
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD5a7857d592288e17079d3b0a59519a5c4
SHA111438536ee297e50c9ecaabe42bec7981025decd
SHA2564258ac8b232b57c2f3bb930c1cf609fef05c502c7179b97dfb252477953aa675
SHA5122eafb58f7b536aa4e5f9dc9eebda82b0f6a6d71d9c56f0a50fa30f5bcf3d65b6a550300f9bbfa2243997b6a7d5cc783e395def392ea7916e3683e991826848f4
-
Filesize
370KB
MD579eee3dfd8993f939216ca040b37955c
SHA19c7a13a543b10cbcdf8130efe221f1d2e3f6b000
SHA256b825a1d163b12c1f8a9b73429afde1fc215825d73fbdab4b4a139625e882e900
SHA512c184210866d9aa396e1d02e9ba448b393e072621732f47b6615ba47795e6511ef32f238a4ab33354b177540e9d05aecfceca86869a2fa6d0d3f2a93d18c9a22a