Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 03:36
Behavioral task
behavioral1
Sample
5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe
-
Size
51KB
-
MD5
5b46556c40cec6090ddf4563a7598420
-
SHA1
319927c223985beb5ccad89d13d01e568ee5a4e3
-
SHA256
ef1595504d485742ecc8328e11a1dfa2af463f90592deee04a82b4706d5c6fc4
-
SHA512
dec1ed43d5a0c10c20c1b9e4c3284e1a90e37750e0d0ce12bcc8a2002df0561714befc92bf987cfee5f1fd4d69f7ca14dbf970a317e95d735bbe35101400c6d1
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQa:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYn
Malware Config
Signatures
-
Renames multiple (5354) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/4384-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/4384-1216-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\dotnet.exe.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp 5b46556c40cec6090ddf4563a7598420_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmpFilesize
51KB
MD557f210c7e2bd22680531b2de689fcbb0
SHA13ad89e7b6834c02f219c156ae387dabd0ad0ea3d
SHA25662199a461fc192060369df5cd29f74628da73962f27b9e18a04445359576c4c4
SHA5123fe371f3687d7ab9625f87b3c21dab8394eeb75d23afc127d3d1e50ac7ccaa09542699c6c7afa3c38d55a081523f10ec2e4a275bfe28dd53e442b24bf7b0fd44
-
C:\Program Files\7-Zip\7-zip.dll.tmpFilesize
150KB
MD526558719703ee27d95503c59da0fb9bc
SHA138267df61f0eaff2b0b3d7d656ead2831b2e7160
SHA256b79a0ac6e50dda2234a301f22d35605d6c44386161ea6719bc883aa7f1806d74
SHA51289ee75ff0678c4956ca1cef1d97d506510b2af0bc6ff73aaa899364e8e6316da0cc1830d093c0b8d8a86323a33e295228b7da1b0a65fb54c5e59a48b7b82eeb1
-
memory/4384-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4384-1216-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB