Analysis
- max time kernel
150s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 23:44
Behavioral task
behavioral1
Sample
1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe
- Size 82KB
- Sample240610-3q686swcpm
- SHA256 a6e5ba7f9b36176b0916194db829f4fe32b472167f9416c58fecb048cb5a3e25
- MD5 1f9c3b490cb8a0f02d724b417878b3a0
- SHA1 aefa7d7cfd0fc2c2a6fc157dffb1a17a3faa6344
- SHA512 c116d2b8e11ca404c6397ac755c4198bf2c18b3dcc4fac30c85621cc225553218c459c4fc6925eeed38eab0a28a52c6507752c6896ca3f642f193c6be78f3d21
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtvQP:enaym3AIuZAIuXT
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3480-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0007000000023298-2.dat upx behavioral2/files/0x000800000002343b-6.dat upx behavioral2/memory/3480-1890-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\AddSkip.xps.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp 1f9c3b490cb8a0f02d724b417878b3a0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
- Size 82KB
- SHA256 0dc4891de67d82f1b5eb3816c2219b619cbf29bab9afc74f504aabb4c6fc8019
- MD5 798357f5a71397f7cbd56d99aa1742c6
- SHA1 4b35d51f700d211d97c1c2ea07186242b715e6db
- SHA512 30f8738e7d960e03c884de4bf1af941873d66796e4d64610376c674c14bc5ecb8c0afdccb065fc8e70a2ce1108afc2d5448dea87fd778c6645a6d69950dfbb9b
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtvQ1:enaym3AIuZAIuXp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 181KB
- SHA256 f58dcfb827b082b15fc6b909c1659188dcb008891ca914c37726fc338ce67b82
- MD5 323171030dc4d77f07b90fc087ff9607
- SHA1 d2dd0b1950929aee34964d2e9a868a8133f6b2d6
- SHA512 1b0a6b082d4eb3a4133f028d46c5669ffe38ede9c3895f9bc63639841cc1e836073b2d4723c836fbe700809d815972fe7d477ead0aa2f147d627feb94e921444
- SSDEEP 3072:enaym3AIuZAIuXYWHIjN3tj6qnv0b2UrXkbvL6:wHm3AIuZAIuXDIjNDv0bNXkbvL6
- MD5 SHA1 SHA512 SSDEEP