Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 05:42
Behavioral task
behavioral1
Sample
224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe
- Size 39KB
- Sample240612-geffessckn
- SHA256 3612c572cbc7fea76059c9daed4fc4596db08673fddb6f3c88dc12f2b2ece408
- MD5 224ece9691b5d05421c3e55be6a33170
- SHA1 33847e7a2755fc527f13b64e708156e3da0761ef
- SHA512 1d4930215e86c87ebdd3e30180a37f3ecad6169114bbf3cd446905f33440f8ac011c329fb64ece7a02d150fcfebaabc3f2498a0d831a3c25585a656b37d5929a
- SSDEEP 384:FBt7Br5xjL2Kd5AsAoh6n5eaOlIBXDaU7CPKK0TIh6Sj31f1v:V7Blpf/FAK65euBT37CPKK0Sjv
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1352-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002336e-2.dat upx behavioral2/files/0x0008000000022a75-6.dat upx behavioral2/memory/1352-1970-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySharePoints.ico.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\dotnet.exe.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEODBCI.DLL.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 224ece9691b5d05421c3e55be6a33170_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp
- Size 39KB
- SHA256 353518bc24896d025a61dc2c0de27836b3f124181b1c3c52fe7d98e6e92321db
- MD5 2265fec655f0987cdae1a2e8c7766f0f
- SHA1 b9737933f4bf6dd5d4f8777905c442a9febdcbd8
- SHA512 332382bda017aafcd48a4a032c7bfa6727d82d81646d3c2df77fc1e8237aede82d7db7b4b16ad5cc35cf88fb10d4207041efad8373272e7219839288cb9bb118
- SSDEEP 384:FBt7Br5xjL2Kd5AsAoh6n5eaOlIBXDaU7CPKK0TIh6Sj31f1y:V7Blpf/FAK65euBT37CPKK0Sjy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 138KB
- SHA256 1d99c204ccbc2549f0635b73b1786839e4bd72a52971737a0058076a2e331b7d
- MD5 e38b3d5f5366900fa5d13e913b1773bc
- SHA1 844411fe50e5ac508199f1b308c1bbd08b5ed923
- SHA512 925e3310402e7ab94bd09cd10188ccdb57f1021b917c54c60c00871b126d0a60d146386e88fe41fb0fc1baa15397354f8dbcbe1f02d3c714c6afdd7f3dd58114
- SSDEEP 1536:V7Zf/FAxTWh4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Dd4:fnyfWHIjN3tj6qnv0b2UrXkbvLG
- MD5 SHA1 SHA512 SSDEEP