Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 12:01
Behavioral task
behavioral1
Sample
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
-
Size
147KB
-
MD5
3902bb4ef3169571b8f38528ce333490
-
SHA1
c76b0ecb934330b8d0abafa47f906c3fa33d5f92
-
SHA256
c46a88b64c78c3fd10bfb3da78a8acf4804ddf399ce88b61beaf22b527482c64
-
SHA512
8d40f59a0a235417d6b747f3e19f422eeaf8d18d2463a1fcea8543e3fcb09f5b6551e2112b92223bff5da5e00c589c8ff9ca994c1e0e3712a12f4194a25e11c9
-
SSDEEP
3072:fnymCAIuZAIuYSMjoqtMHfhflixiiJYoAJYod:KmCAIuZAIuDMVtM/wJYoAJYod
Malware Config
Signatures
-
Renames multiple (3438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2928-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2928-536-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\ConfirmMerge.vsw.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\ShowUnprotect.jpeg.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD5e04ff2366c9bb560bbd78178a1f14c5e
SHA1c320745a12fb1a1ca919d5902661c92ba3aa7976
SHA25658aacbe8454f5f4ba4c90f7dbe196806725875db53cc59e499b62c3a774e31ae
SHA512cef1fd100a66610b390bc721f6c6442f3e8b90981b30c985561fcf858a5e8a7a650a5c586ae2ff43a1fc304be5cb1c8ed72b76bf32b4c1f3c4e2756c61a7eeca
-
Filesize
156KB
MD54938cba26541186a8bfcc6c5a3aca734
SHA1430e3a41cff814dc43d883d5a613b8ee6e06352c
SHA256129826a563cca589606384fb650a9e50932b45a135bdb2469858faa3ac7fd023
SHA5126a6e7129cc4d297423e16eafaf2a39a0c270b14adda50d21c663d2d28f9090f5e2dde0d6734b8c416e88970990b1aee6d07294931fe2b39c8ecc553903738892