Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 14:02
Behavioral task
behavioral1
Sample
4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
4027e344d6dc9112e8861bbb5af594c0
-
SHA1
d58d72c1bbcd341c9cab697fd63df37f64750e26
-
SHA256
d12f3c83685e2c8b3b8330992131c3e05d29f8d6d47f6ff27d43406a18992430
-
SHA512
bb2d37bd01841275541e29f307d4480617ca9236495a6442eb73b2153b6cfe86d589e45c2f46a042bf75b81f1ccaca117d311d2a001bbeefc9efc8ab05dd4ad3
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IH:fnyiQSohsUsWU9BK3H
Malware Config
Signatures
-
Renames multiple (3472) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/1652-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/1652-648-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_settings.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\jsdt.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\settings.css.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DebugRequest.dib.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\accessibility.properties.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp 4027e344d6dc9112e8861bbb5af594c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD56f59c58db78567dd65383fdca3712d25
SHA11d527f78397415020c973ace765d7860a98c4543
SHA2562b8fab7f7c8e1fa690c86173fe0ea0a0ba28cb1eec89bf82de5a291dd1f80862
SHA512c80426efd39fff858201479a3c8a130ba7ace62c28da97bdd35a9bd0b54bcca3892bf9ee1dfceec538490772fdc985e4d192efd97030ba80e39b051e99ebe295
-
Filesize
90KB
MD53edfa80b84c083decea74e01fd0a28f7
SHA11dd16bea6315d6caff85ffd6ff9bfc0eb61e80dc
SHA2563607bdeadd483600649690107cace1cb18203fb4a39d557e09a1e90cd4774e63
SHA512f49af51b1bdc2e45856ff163f403236b6e9eaba68eb5475102943a078ad2b6824af17f304d5deea717ba86e4cf58913c2246826e9a86e471db24ac0bdbf6772d