Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:18
Behavioral task
behavioral1
Sample
5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe
- Size 9.7MB
- Sample240613-exf4katfrh
- SHA256 dff64a5ce53a9d42f9d857f95abcb5f377988091f8ba3213a92861711422d4a7
- MD5 5dd6b1fb125f6dbc37b2891397bdf0d0
- SHA1 5ff4eeedec2e2e52c64775b7ad07ac6b0a76cb4c
- SHA512 dbeb7f9d1cf0316e0ba6c8743181118d09e0ffceb97ec1ac34db91cf9842a09d52000999d1387d793aeadf6f06e0cc8715673c3c79795fcef3ca6853aa6cb450
- SSDEEP 196608:o5jdBg9pVMgl6GmTGRxKDTiw9KDVWlZh+qoeMKWgGM8J2WVCiDTUzq7PQ:OjKpVplYGRoDTh9KRo+qoeMf37JXVdUH
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2168-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000f0000000234de-2.dat upx behavioral2/files/0x0008000000022aad-6.dat upx behavioral2/memory/2168-134-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 5dd6b1fb125f6dbc37b2891397bdf0d0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp
- Size 9.7MB
- SHA256 ca4fb46ca9f192ad851a6cd52cda34bbe2330dece9e4b1e8230fb81e084c491b
- MD5 9ffcfb66b228bb6b88e0c874135e9a7e
- SHA1 0a6f7a81f6260caf915642d0c7ebf1de31e1f594
- SHA512 182ce884203584580fe83cbd7a02912c9243daeb9ba78be63431fa41a7390a832132093debc08f03621fbc1c3c2de166112106fa724bb8f16c2a311ddb802447
- SSDEEP 196608:o5jdBg9pVMgl6GmTGRxKDTiw9KDVWlZh+qoeMKWgGM8J2WVCiDTUzq7Pk:OjKpVplYGRoDTh9KRo+qoeMf37JXVdUr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 9.7MB
- SHA256 ba0529e3ed16dcc3c55689c699f7cf61bbe3ff45cbceb4ee17ef0b36865a9a27
- MD5 8af5ba7226ed0cf77d585c2f6cca4244
- SHA1 25daeefdf6960e17c26ecba2cc3d2cb368edd094
- SHA512 d7a3e1a449f2d859fdad97a9fa7cb93108c69e35d08cf9c25947b1d5245656410243684161d178834b3d453f49772b3d99625b01095c3828c13d171e4c27692f
- SSDEEP 196608:o5jdBg9pVMgl6GmTGRxKDTiw9KDVWlZh+qoeMKWgGM8J2WVCiDTUzq7PK:OjKpVplYGRoDTh9KRo+qoeMf37JXVdUl
- MD5 SHA1 SHA512 SSDEEP