Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:50
Behavioral task
behavioral1
Sample
54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe
- Size 54KB
- Sample240613-b9dbnazene
- SHA256 2d7780135266c06e0f3dacaa3504205a792e7cc48c1d0ec57bcb40ae354399a7
- MD5 54cbba1548f897a9e5c985ca62986530
- SHA1 7d737cdec79fcc54e25af9a946bcc504d6aaa706
- SHA512 fdfc8ee693cc1aca56fa8369832f3a8d0180bd94fb5e827c065bcfef3085892a0c139b43a2aee9f4dfa6013f4805fe14e741c37f8d558210fdcc4950f99eaad1
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQ3:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5265) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3380-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp 54cbba1548f897a9e5c985ca62986530_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 54KB
- SHA256 6cd7163d297b435c5749ae5dd4b81d42b968457152a5444ec1c310c178186a45
- MD5 8898f8badcadcc7e80fb5a10867e6b3b
- SHA1 734533e568c350935ba93ff90f713fb893ff2ea7
- SHA512 0ba1c4c553ed987292ea24481e3b44b1cec508d9b5cd17b24b9bb9bd58b2209e786208a825b32c2438af96b6885e6f03c5630baca92fc5940a4e5ed650910b9d
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQJ:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 153KB
- SHA256 36cc75350f90eb3ab320e67bc820aeabe3dfa3899eb393149fc121d131797f1a
- MD5 d680884f55b63b50e8d38fbcd94590fd
- SHA1 88630f6709dd49a04ee3f4613136953b44ea6002
- SHA512 076322fdd4081e8cb97e5992db36e94decd61de7ef150b04819979cd35ab2f8ef32cd5197fba3056252dba8f285c9521e342b2f70ad4647ce5402977a8eb57af
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RY34pWHlPEXZzjUq3th5f6utM5vLNinVmWy:KQSoskRYuWHIjN3tj6qnv0b2UrXkbvLE
- MD5 SHA1 SHA512 SSDEEP