Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 13:12
Behavioral task
behavioral1
Sample
3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe
-
Size
101KB
-
MD5
3d370a08ce3c82fa6ccd41346b906580
-
SHA1
52e960022bd5b8e58aac82aef9efafae4d6ab87f
-
SHA256
a5aa5039316d64afe7234defd9c007e4ffbbbeef66915a7490dd44c33c7b2d46
-
SHA512
19db8c9d29953403acb86fc8e7ea609bd4de2017de708d57a985474d7bb89d91cbaea5b993deca5e0785ea97912df596fef947a77670b3be0fe8758654695f61
-
SSDEEP
1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulG:enaym3AIuZAIuyxJrQulG
Malware Config
Signatures
-
Renames multiple (5092) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/4016-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.chm.tmp upx behavioral2/memory/4016-1800-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Java\jre8\lib\deployment.config.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp 3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3d370a08ce3c82fa6ccd41346b906580_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:81⤵PID:4088
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD550348ec0d93a50a92eb5fd97db461573
SHA122fac82dc4113392bbbdb183374f7037deac30a7
SHA256430484cd598533a24c2ecd3cfaac6387aa577f5231b469210bb5ed7f1a99cb88
SHA512f51985624498903b0b32ae5c08666369aa756fffb0c627ffd66aa258ef88d9a549cb0d66728cae970a27dce9645f42f294bbac13e7fba35f8ce330bb129ba05e
-
Filesize
214KB
MD5d45c5c02dab537436070888956b70757
SHA1f0d9bcab98408c9fb2f7566aacc4f258e12dab67
SHA256170cdff70c4ff855c9c1451a98fba9ed4414814e4ab2d63bed4fa0494c5f1a85
SHA5126725c66c136bc8676eff0c4f307850eece3eb09572a947d495e7719f748e6261d0ed3af5162005c992a33a3c0283cceeb42613e784be702c58e42c677c1af1da