Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 12:05
Static task
static1
Behavioral task
behavioral1
Sample
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
-
Size
78KB
-
MD5
394bcf9d882a3033a05c141918bf6b30
-
SHA1
8e4bcdc061becb7e96bc2d703262eef91dea5771
-
SHA256
cf81fca239fbccfcac1cb95d68db3e8cb45ffaf627b0c00db702955a16fea02d
-
SHA512
0e623739fa8062b02154b80b4f985b1210e73538a87acc324c1ac7086034f5645d1c0b000958b37b506d5cab6617ca250ff97924d8456dd61e913330c372f51b
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhP:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsG
Malware Config
Signatures
-
Renames multiple (1344) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\CompleteRestore.jfif.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrgc.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationCore.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.AeroLite.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationCore.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.Extensions.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationCore.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TraceSource.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClient.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-memory-l1-1-0.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clretwrc.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\ReachFramework.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationUI.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationFramework.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Input.Manipulations.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsBase.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClient.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Xaml.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:3932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:4012
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5f224df7405b8bf53f7a75a5851337658
SHA1ac46708520c1bf8e8bba344c04c60c3228ffe5dc
SHA256f7c49945f74a05eeb8a5646d502817c47093fe88aee6e4947e1f6b34018f2bc6
SHA512fab29a6052102cc62ba488cce4566bb6fc254bac24cccf4a9918a9ac1fdcd5fcd6d027ebce0d0836eac23c3bbf72a90f246d42b00536d574f73c2a4abaab8b74
-
Filesize
78KB
MD51bd4a7793091bf01905058ba2f19eafd
SHA1983b8fdafc12f6ca9f7b0bbf9be5deb70ceaaff5
SHA256fdad95589b5ca52a65f439d4b0bfc91fde86e858c451eb313363af62f526198b
SHA512d38f3916b994d82fdaec02b631f9776a837e4284921d1cff55959556486488c1721c91249db018a6b75ea475b7982d39dfe6e55f7f875e7ef0c414d21949b21c