Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 14:01
Behavioral task
behavioral1
Sample
40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
40259203cfbe6ec709b140a907d98ad0
-
SHA1
19755bd7322f9d819da7fefb4ab7846d24853816
-
SHA256
970ae2d3cd41b5e6d861498ddb802149e62df02d3e4b8247da5c6313b4380a7c
-
SHA512
31e9b3d47d2231441c45187b2ed79365264c2fcc8f5dee9463f177fba32e6e2ceb2cf4ed676aa46d74d6778381b8d8a564d3bc06efe982a5cfe106bf50cdb35c
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8wY064HD/x+ryBzP5um2F3gx+lXgXa:KQSodY0dj/xdxuPgklXgXa
Malware Config
Signatures
-
Renames multiple (5078) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/3764-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/3764-1106-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jmc.txt.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp 40259203cfbe6ec709b140a907d98ad0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD55eb096d1a68dce62c21c31c2f84140ba
SHA1a0f8467b8d317fb835c1b3971a9818b9ac8825cf
SHA256c94da915c70958d3279834cf3813e03375bebfbd49caf2d9287733ab4e7b120a
SHA512cae8f7b14b7dd9aadefd0beb2fce7e327c8cce872d68ac7317c1c928c316ca5f96eb4981d6faa5d2dc5269647df14cf49e7a85e4500335257fe33d11e467f8af
-
Filesize
193KB
MD5bf927ebba055b7b50d973e4ae8fb2330
SHA10c0466a6ffba377004dec7c14ac9e000b39f8c0c
SHA256a94372d4fba3ac827ca2cfda66d78a552696a439478a4f19ef7d4eeab211ea50
SHA5129f39c9e596c583eabff6d773d3b38d257f4a4127ffde1a0291109672aa7320b44e4cc601965fa98c246a4a6bd31cdb4e90f221b1d860f4eb9d878cb494b93776