Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:54
Behavioral task
behavioral1
Sample
1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe
-
Size
52KB
-
MD5
1fd5cebb0c73b868003f5ae651bd3b30
-
SHA1
746629db4ea0d8b1e45423a1abceeb95665abf93
-
SHA256
73a6b25ce551a41566aad6d36f3ace12ccf46f18ca109762f4796cba125039b8
-
SHA512
6ee65044bdba27350a728907f7dd8c66a7a7dd868758c787aa7a6a48fff8cffe9fa83fda202241f78b592c171aed161f0134e0daabfff4997b9aefe22c4de183
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQm:CTWn1++PJHJXA/OsIZfzc3/Q8DNcfNr4
Malware Config
Signatures
-
Renames multiple (1630) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4656-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0008000000023259-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/4656-310-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Immutable.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsFormsIntegration.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Permissions.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationFramework.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClient.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Classic.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Xaml.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-profile-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Input.Manipulations.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClientSideProviders.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Intrinsics.dll.tmp 1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1fd5cebb0c73b868003f5ae651bd3b30_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4656
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1268 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:2612
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD59b0588f56ecd252f7636b08203a0be9d
SHA1194cf2640d071d658e3a82fb44af75bfb1616109
SHA256e5a960dfaad6588a16280cd888d6cde54d5cfced001d321813120d28f0b13230
SHA512c50b83e7f1813741d6dacf05a8687ef538253f3c34c9c069e51c8bb44e40c1a77c665df2ec4cc0e2cb2c7bd1e9b94db92b191c13477a18402ac97d5cbe54a5f9
-
Filesize
52KB
MD5cda0e57b35852381be9b9533bd58e448
SHA1a097f180a5dc648be2443dc5fc12c1094472f5be
SHA256a0a7205619d99ff456687fb2120b198eb248d0cd7f1a9e2bdf6d58bba2ac49e8
SHA512a37b469a872bad69a84c9be957c5c2386e1a875e694aa34bf51ee62c3ca73e66518c3a11fc98d4e523a2f421ad11a3910f2381b969f5a0ffa28df1e8c5eb90b3