Analysis
-
max time kernel
158s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:36
Behavioral task
behavioral1
Sample
22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe
-
Size
45KB
-
MD5
22cb83a712332d25ac168eb696b34180
-
SHA1
cbe4ab25778237d8801faa7ad193ecf08ff6bb92
-
SHA256
bb94bee6c6c77e1a727cfda5d02528a049ef1297ccc4aeb3e663fd2026ed7a1f
-
SHA512
2db4b57a0eef2aa07092f3d6a8c16bef670e81d504f06fb83bc9f2d0ee94738c5b89db3055eaaf9ca6f88194eb939eb867e1a6d83d7163b447395949163dbe04
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFSm:CTWn1++PJHJXA/OsIZfzc3/Q8SNkNT
Malware Config
Signatures
-
Renames multiple (1340) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3080-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0008000000023253-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/3080-18-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Sockets.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Cng.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.AccessControl.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationUI.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Xaml.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\ReachFramework.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\CopySave.xht.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.OpenSsl.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsFormsIntegration.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\WindowsBase.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationTypes.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationCore.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Input.Manipulations.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsBase.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Controls.Ribbon.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceModel.Web.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsBase.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationFramework.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClientSideProviders.resources.dll.tmp 22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22cb83a712332d25ac168eb696b34180_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:3080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:4216
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5d68654f35e2bcbeb280ceb410a3fb6a3
SHA12b44f885834d51ae1ae2557422953e639a48a96f
SHA2567cd40c6e5f66e08f6a2b8af54314c3fe2fecd44f3588c4cbfeee713c1f079b9e
SHA512c06f1187a0022f71c910225ea2e40d26682ac04ba37a7351b1cb1081332f6d7357ff945d1c3b656e5fccd16650cdc43a72ca76bba3da15f710597e9d86d443d3
-
Filesize
45KB
MD5eb0df92c240624be2b148d1c5a56b088
SHA16e4dadb253c44fdb7b4cdafb98dd5547fbb12bbd
SHA25628d9c99757b8f97eacb5349e03c31b301c4a5d9a3de8c56d8d92e4a1f540c7d7
SHA512f130a4c788ce0029d478230fe7cb816d37b0736beaa09b20bdae7a0ea3a4aa7cc30c7845e94573b1ba6d11ce898ec2991b055a1fd97e463516d7037da659ec43