Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:36
Behavioral task
behavioral1
Sample
53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe
-
Size
46KB
-
MD5
53fc3f68dd05b8433d6a42588e0511c0
-
SHA1
5657e7438e25e3611451bae899ad838e0de3a69d
-
SHA256
f22674d926f5e0fe4c21fd60f9fa8a88d952bc1cb4d2ce5105caa06e900b13ef
-
SHA512
ca0633064a5e3acaa6a993850dc4429d4446f704f7e57fc497e7dc3acea0a22bb2eca571f6c0c3d436dc16c94eb35d1775ca0a9e8e3b543a8adc47314356f4c0
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQg:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYd
Malware Config
Signatures
-
Renames multiple (5246) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/2916-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.exe upx behavioral2/memory/2916-1216-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-BR.pak.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 53fc3f68dd05b8433d6a42588e0511c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmpFilesize
47KB
MD582fa98ddf494ec9caf51e5d5eb6b8a72
SHA17159672341a05815b176863c33f59a8bbaa1263d
SHA2566006b93dae62af0b76fedf653e144c3dbbca55ff8dd8db92558029f85f9d499a
SHA5124044090526f0165319c00a7822a59b73aca0aed25d1e64c980d69981cfdcb1d1eb27bed2697abe19bf5b7f3d9f1a5d95de1c18b6b53a0c819bcb91e6cdba96fc
-
C:\Program Files\7-Zip\7-zip.dll.exeFilesize
145KB
MD509d9aaee9046b189c3185fbb9543483c
SHA1acdfc9577aa905d30abc867e74d5ce67d90e5022
SHA256a8b406c1e4a7d82728f8e53ca91277b66998fcb0c16b5d17fda9fe2d85297d31
SHA5126dc65cb3c12edb986bb9efbdc852d8e701b5cb4f2723a26ce9c47bdd084f46220ce1cdb32f1e384e0103fe27c5557b1f6233973c2f07712f59b94f0f1a140fbb
-
memory/2916-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2916-1216-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB