749fc7e72cf648445b02c7237f61b81356f0ff52f253c3e0a417746f05394df2

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
Size 54KB
Sample240612-jraf2sverm
SHA256 749fc7e72cf648445b02c7237f61b81356f0ff52f253c3e0a417746f05394df2
MD5 298b1136b016eaf41074c19d5bf5f3e0
SHA1 1a284fee147a0380c6ecf6df83e9cdfb593f82f2
SHA512 138c918b912f4da9a8ca9bdfb73d91fa502c6c312a7310ee0ab41397b1d3ba89236e7e2ed30ae11fbd11d722a0f43124db17e7176a694b1c5ad2ded3318b4671
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcG:/7ZQpApze+eJfFpsJOfFpsJr
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsFormsIntegration.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebHeaderCollection.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.SecureString.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.ThreadPool.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\vcruntime140_cor3.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClientSideProviders.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationCore.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.DispatchProxy.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationUI.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\PresentationCore.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Input.Manipulations.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Input.Manipulations.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationTypes.resources.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.AppContext.dll.tmp	298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\298b1136b016eaf41074c19d5bf5f3e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 55KB
SHA256 fe9b393782b1625574ca9df1e92e524be0aca74eb6267d7cb8aab8aee887e985
MD5 baa376f4d5cb196f76763dc84d922fe2
SHA1 44dd25464e22d9af823c2662f2780866c950c689
SHA512 7e832325b62aa0e76b860b496c47709f285f9b09baaab7185b3b45d2bd4c5cdcee739e4598a3acde35c6f7d855780709a697d41692967ff748c28e96af46f416
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcW:/7ZQpApze+eJfFpsJOfFpsJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 54KB
SHA256 12119f2a8b379e57c3e1f3f3826a6835ff094e809e8d1bb68d467d24d71f870a
MD5 ac2668a97d8c9ffd61f6c388f78104aa
SHA1 12ffddcaf265eea5a6d25a107a1091ab0b5c0b5a
SHA512 44360fce50bb09b4ee3019c7b5d11a5b3d5f828cbc835bbbb75d2ccdd8a1ffa1aca18766dcadbde4eb7e6dd41cd6a1a7fea4be27efe615b7c59d5548432b8f56
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJc8:/7ZQpApze+eJfFpsJOfFpsJ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/636-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/636-444-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads