Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:25
Behavioral task
behavioral1
Sample
537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe
-
Size
46KB
-
MD5
537e9ca6341e87422a0eb9089e722020
-
SHA1
32f1114da28eac9bd2512c2c15131f830820fda6
-
SHA256
0d63bc138e60a23b18fb94e8d2cbc14b3c4b3a9663d9620fbd7131be56431157
-
SHA512
cead37c84767e2635fd9e6a6683ea42ed42d017629393621e8d4bd99cc6e950ebfd615c2db7790c810bb84a9f80348d1194db2306aa24179f097e950bab07c79
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFz4:CTWn1++PJHJXA/OsIZfzc3/Q8zxC
Malware Config
Signatures
-
Renames multiple (4994) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/2640-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/2640-1010-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp 537e9ca6341e87422a0eb9089e722020_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini.tmpFilesize
46KB
MD5fd5b9f0ff581be6192b13b42bf563270
SHA1d7f1af1064d35931588213e1f76ec821d357ec19
SHA256960a39d7f20bc94200da164558330e6f02843075a27dd4773bfba08b07a1b765
SHA512ab21a4f5a84698dd8ed16e47ba4f63edf3f256ec279c2d592e70b04eb059ea3b0af587a7bd65dabafe006ddb6f53ac5af278f4d1473bb238ed7aa5badf244cba
-
C:\Program Files\7-Zip\7-zip.dll.tmpFilesize
145KB
MD5a48b16497282f13b7503f18d8460f125
SHA1474a7e03c9af833e9d966be6b83a2677e6c1657b
SHA256a66b73ae687fa5064a45107568d6aab65cf198400eb2d132e26eb707e47c7726
SHA51259765772a335eeeb823a3b0bf2b6a5c7eb1270809db921a045e0b7dd3497646c6a9ad5386eccd6dea0efa391496466205b9b4bd27c8a716455d065956b52b60e
-
memory/2640-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2640-1010-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB