Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 11:57
Behavioral task
behavioral1
Sample
38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe
-
Size
46KB
-
MD5
38b4f00f272ea45736d31741a3c95450
-
SHA1
6988836cf9d5294ea45790bb9395e36c4a5223cf
-
SHA256
215a4bbfd2fca313e53bd09f6a2f8e8da0451b97ebe3bdf822febb69d302b316
-
SHA512
4a78058a4b48d5a29e748f34ef15716410d7da2ff637b6e7c6974d5a0927408ab9e768e70d0d28cb5ffead45cf8d02331441558bffc0fe866c7758e38f1e34f7
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzv:CTWn1++PJHJXA/OsIZfzc3/Q8zxV
Malware Config
Signatures
-
Renames multiple (5279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/3756-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/3756-1214-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp140.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-process-l1-1-0.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL.tmp 38b4f00f272ea45736d31741a3c95450_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5dec233fec93d9254d62618ace9e329fb
SHA1ee58b33a2df859d9fd9a8fc016d5980e0e4a33f0
SHA25680e407ca75707b5b9101ac804c9eee07c0f6def143c51312f8fd574dddd7af00
SHA512378db26cbec7cad9a1d7604ee08b0acccd1df982454ccf5c5683bb8e5a7fbfa3000b97a56e3f798146466bdaeb3add02b2637b33c4ee7e1a0b769986059c24e5
-
Filesize
145KB
MD5c7a6998659791be110d1673c3eec5604
SHA12e60b5427e795ef90632758c879a31eb7b023899
SHA2567406584f9f72f698c88772bd626b297b3cc38e06cce5e230b4ed202fb1487fd0
SHA512ce9e4c75c10022df88a0c029758f4c1cf83dd76e6f3dc3b02989ad2bf3e989e7f677462fe4e70b91dc89020e86f531ef08fa9e9a13de071a2a801dac10608d4a