Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 12:01
Behavioral task
behavioral1
Sample
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
-
Size
147KB
-
MD5
3902bb4ef3169571b8f38528ce333490
-
SHA1
c76b0ecb934330b8d0abafa47f906c3fa33d5f92
-
SHA256
c46a88b64c78c3fd10bfb3da78a8acf4804ddf399ce88b61beaf22b527482c64
-
SHA512
8d40f59a0a235417d6b747f3e19f422eeaf8d18d2463a1fcea8543e3fcb09f5b6551e2112b92223bff5da5e00c589c8ff9ca994c1e0e3712a12f4194a25e11c9
-
SSDEEP
3072:fnymCAIuZAIuYSMjoqtMHfhflixiiJYoAJYod:KmCAIuZAIuDMVtM/wJYoAJYod
Malware Config
Signatures
-
Renames multiple (5019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/224-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.chm.tmp upx behavioral2/memory/224-1790-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\external_extensions.json.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3902bb4ef3169571b8f38528ce333490_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:81⤵PID:5088
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD57e20c0060445722602be9724ec2ba914
SHA1916f1fddbe600e1bca5b5aa27fe38ace48c38065
SHA25643e4cadb3147cbe5b262566448ca7105cc9c9af10b0e6d4956f9a43b1028d6fc
SHA51209400172346ec57ffd8dceb3e418dc8998f31f0bd7a0765eee27ba9d805681b869d05a8bcad5e215b46f8e8e3739457273733a587f7e8ecbd75016566e9fe835
-
Filesize
260KB
MD5cc8f1a0af5bfdb7c8668f83ec8534cf1
SHA129b9707d3453adbdfac49ba4893668816230b8c5
SHA25667cb8e4e16636549dd7eece77bb179a0961a220845fbb43c2b796b47afc3d435
SHA5126010bc6066d60643e5a597e082aaea7b89e9861884c9d5257ab627e14d37bc384763dbf2242a51e7956d970adec69d2704ab78e2147de8359c1f6abe9dfc4bbf