Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 10:08
Behavioral task
behavioral1
Sample
31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe
- Size 1.1MB
- Sample240612-l6dhcsvamr
- SHA256 6a0eca79d988afe3696a368d36240079b8d4fe9d7c41c89b871341c4f02977ec
- MD5 31cb2d3469629d6044111a75291af360
- SHA1 6741f1ffafb89750d2c9353ab1a205dd2809c562
- SHA512 1b1567657dd7f373c6095dff5f07ac2fa83096e0651411066c71dbd4357de5f0d661b1b18200c978624a073b8a9b0f54c8a14f215e2af508702484fd0bd933eb
- SSDEEP 12288:IAIuZAIuOwDQ+CBzxTCpEr1Ms5x3aOuvHCn9AwoeERBDFz8eIfo2Vf:NwDQbhEEoQf
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (2302) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2108-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00060000000232a4-2.dat upx behavioral2/files/0x0008000000022996-6.dat upx behavioral2/memory/2108-856-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\gu.pak.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp 31cb2d3469629d6044111a75291af360_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
- Size 1.1MB
- SHA256 4847c9c12e8bac18045a2cb22bc5481d5b719ec2ccd18d8a89ae32a76a69e2a9
- MD5 a9bb81e29f5dbbd64636cc1b88d13ec6
- SHA1 1305dc016a54dd31c838fddab4195a07e5c29b64
- SHA512 83e8e8e50d6ffdba273b530f2a360a793a11ddee18be25bb81f19eace3aefb9e1fa97e3ad5bd5ac0f2f8e7ad795fa319d419ac8aa84014704a83a17abcfb509c
- SSDEEP 12288:IAIuZAIuOwDQ+CBzxTCpEr1Ms5x3aOuvHCn9AwoeERBDFz8eIfo2VT:NwDQbhEEoQT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 1.2MB
- SHA256 1033a62b8d50f59bbb662549884411a2708f259dc3c5e74c9469633e78c70578
- MD5 b1f37db6d8e9a13f529320cd58d734c0
- SHA1 2003303a72613f6800a22eb0e427bc1b8cd0398f
- SHA512 4d6ca93275fba66d3817e1ebba1dd3a7d1871a0b0053514956a300fa1a20b30c0a463385b02a9d63fb56bf1872eba7559c31e27b4ed5f77692755a75462f21b0
- SSDEEP 12288:IAIuZAIuOwDQ+CBzxTCpEr1Ms5x3aOuvHCn9AwoeERBDFz8eIfo2VdIZGNXkbvLk:NwDQbhEEoQdIZaXkbv4
- MD5 SHA1 SHA512 SSDEEP