Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 14:03
Behavioral task
behavioral1
Sample
4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe
- Size 68KB
- Sample240612-rc198axfmc
- SHA256 e9f5dabbd2194a2e845c293fa812dc8aecd1fd61b48b8f48c148718cf0b5932a
- MD5 4048dfa5c8639391337e7209cecabae0
- SHA1 493354f299ed30ec98e77c7222dd9dbd7b27d48b
- SHA512 2e7125a042c9f3c23537c9a9480698c2833989144cd222cf445e8ab73a1c53933a404255ed27ebfe7434af327b688862edf4878dfd3fd3baf52331fc9e58a074
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8w9A:fnyiQSol9A
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4564-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023370-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/4564-1950-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp 4048dfa5c8639391337e7209cecabae0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 68KB
- SHA256 64e0a71912e6faa73a21e548a054ef66b0ed3dcc0e2e9d56d8866b2b836b3a4b
- MD5 f2b5601f2c2eb9cd47a694f0812cdadc
- SHA1 9ce6a80dffd8ff169f49ea38fedd5a2b92c9021d
- SHA512 e1db5e98242e97095cbc773bcb730f52bbf127e95f8c85b9295e14c061566196975bf566d4bd46fb9cb5da946d2f5dd551e3b075b154f3a1f5c0e0faae6c36b5
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8w9S:fnyiQSol9S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 bc0c4ba72d2382a868b3fa33a406c1ce9e13fe4c50de408027e5678285752b97
- MD5 56b9c416bfbcaac30f20fae80257a9de
- SHA1 10d327523adeb2123f3f757735bd64f56453e84c
- SHA512 489062eb3ca6cc0da8a0d1e48fb028d06c72fb459bfe17691a4e0aae525d2477034a1024843172cf68dca01b37e6a89d895695854b718c97dd9561b9dd6d134e
- SSDEEP 3072:fnyiQSol9fWHIjN3tj6qnv0b2UrXkbvL6:KiQSol9UIjNDv0bNXkbvL6
- MD5 SHA1 SHA512 SSDEEP