Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 13:48
Static task
static1
Behavioral task
behavioral1
Sample
3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe
-
Size
41KB
-
MD5
3f5a70b03c7345a7f3650433d0e0fe10
-
SHA1
969ae5bf867daf47697416ef9b69139c2aa2cf6d
-
SHA256
588d70e082058cfcb79b1ec14c868af9096d2d3d82baa215e328559f4b9b227a
-
SHA512
753f0d88f28a3b0701837860a5305c88668b5eecf12c92efa152c3cda06cfde003d45eeb39e9339abbf53e46dc58780660bc76c589808e53a6a7b2ff1679b445
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFAHslM:W7BlpNLpARFbhblkYlkuvIYFdu
Malware Config
Signatures
-
Renames multiple (1601) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.Linq.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsFormsIntegration.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Xaml.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Design.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Primitives.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-utility-l1-1-0.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.AccessControl.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.DataContractSerialization.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Ping.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationFramework.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClientSideProviders.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebProxy.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Primitives.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Overlapped.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Printing.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.AccessControl.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsBase.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXmlLinq.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3f5a70b03c7345a7f3650433d0e0fe10_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:1988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:4896
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD58af82d1df1844444ada778fcddfea20a
SHA10adf0ca1755a53dc4b4658cc28c2ba03e54fb0d3
SHA256f4e94f3e624875d83c221629bbdcb69f615223dc802eb585ccdc4d51b0abe5c0
SHA51209efdfbc09911080935be0d7932a904dd8f9bd346d5015a0bfb6c7274093e7259f0673b3ca87ee59286d54b4f284a7cf332f3ad52c8cbd82bcaf27f310e941e4
-
Filesize
42KB
MD54fabf610ef883860b5839a5a4b3317e2
SHA1e24d4931d319441ddbc9390fd7d9f1b1cbf78a82
SHA2564e6dc8f95d27903bb7ad3f53fb88f9ca3a98025179dc5c31408ad957363d5fcd
SHA512f7ea89806cb7f0c03d0194dada2e806ba9eb0e20e117d74b5748a00ecd05a69e1d7e334429ce949f3bcc0f734968fb54d71231ca347cc8855b9d5612cdb32cc8