Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 11:44
Static task
static1
Behavioral task
behavioral1
Sample
37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe
-
Size
93KB
-
MD5
37b65fd8da174505fe39a409a9760e80
-
SHA1
f0ce29ec8192b5f25361fa836333e836456a0483
-
SHA256
2a56914777cafc5db8a84ece39939e0cb01ac6147083e7046bd2c84effc51cdf
-
SHA512
bdf4b48e915b1e074e0c63f89c6a3de803677305c1919c27d02e71b2296f6dcf29968160adbaa3fd9b95e8502b091599b38d4f9068aad4caa9042567ac122eb5
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaqvr:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXn
Malware Config
Signatures
-
Renames multiple (5050) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp 37b65fd8da174505fe39a409a9760e80_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5646ca042619bc3e3ceb54b704f775d31
SHA1c32f9bad6432f71e83b791ae29fc0c140d79b81e
SHA25639bf42e7912ae1280f81e1c5fbe2a23a0d87cf225cd876dbab12d52b9d8d96eb
SHA512c98a07d262f8ff79474b42af25e53f6535d2d4155a498cf49f6db47fdd7c0f9dc499a1b8e77c33107ebc4325ab13d19e9e97889a63b0bbc5d9285540495633c5
-
Filesize
192KB
MD5a518e9cba0406df944c5cf5c33818718
SHA1ff6e9a66be61cde0bdaef095d7d0ec48559dd233
SHA2562de91d7fba0c8a1500612f2c7967d119aa67a38fd494b3f63bc957a983a9652a
SHA5128986a15c7085f7b09315269843df1d7cd57efadd0e29de7862e34c5fe7ccb505c3163a685a5396cde7d678c296ff1663b8b49a6bbda7395b3fb4fa5010d57294