Analysis
- max time kernel
150s - max time network
119s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 11:35
Behavioral task
behavioral1
Sample
36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe
- Size 128KB
- Sample240612-nqcl8sshqf
- SHA256 3a648ad9eb147c8f6278edd036b8595d7987b89ec74d75a6c58fc6a9944c615c
- MD5 36f92911e57b006807de506cbe2cfd40
- SHA1 bff3564968e71eb51748ab0802cdd9b85dc9d804
- SHA512 800a1c1b9527046747d544dc15732188a422a78593f601ab0fa759b77248dcadef0fb1ae0233493f14507c47d89e986b400f99bf0c3983271003712ec7210094
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IFqgnDfdPux8I20AoGL:fnyiQSohsUsWU9BK3FqgnDF2vIL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2388-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b00000001444f-2.dat upx behavioral1/files/0x00020000000106dd-6.dat upx behavioral1/memory/2388-650-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\jawt.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\F12.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp 36f92911e57b006807de506cbe2cfd40_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp
- Size 128KB
- SHA256 fa62259b66fd24e221392a20b05a2c42048cd4d55120ebc2c84c1b03140e9e36
- MD5 f0085a05f74df3d6772fcc65d5a8ebd2
- SHA1 4ab686f7d0f5c1f0da98ec5a3294de0cc22d5b8a
- SHA512 6369fc1f76d1eb368f382e2067bceee0aef716d541310a91edcd739f5c6952b68ba3937781eecd12440a9afd3bd4b57236312883d9d6acbea945af6c976af3a7
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IFqgnDfdPux8I20AoGT:fnyiQSohsUsWU9BK3FqgnDF2vIT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 137KB
- SHA256 2f89367abcc8afeff88a008a08bc427eb50d5031201cd83c092e6080c59a8b72
- MD5 d0f6a53eff6e00b9060beca81aca171f
- SHA1 5c2893d70c0f3fc6a63473f388e88c524cdf2356
- SHA512 701095bf54963764a6eec78a21f987b3a9703e14a6fd8601353222ee8b2f78a2eeacde6f7b04f80e74153f7964d9cb13dd0317c33be9a69d7f0784d683e11c3b
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IFqgnDfdPux8I20AoG5:fnyiQSohsUsWU9BK3FqgnDF2vI5
- MD5 SHA1 SHA512 SSDEEP