Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:47
Behavioral task
behavioral1
Sample
71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe
- Size 138KB
- Sample240613-lsgmvsxdrn
- SHA256 6c5cdb46e6df5982fe0ae32142f1e80b369812c7fb6fdd15236a2e7574ffbcdd
- MD5 71c39fca938148cf0d415bd4f7bc5260
- SHA1 8bc7c19ed224a2d70bf4330f5898de65968316a5
- SHA512 d1fee024034916122bcc7c5cb7fef8ef338c9baa3dabc0cc309932cd51e06fae4f30ee422f3d24d407d6ad2f245928be5b20159ae10266ea9003921e6ca55034
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IbTWn1++PJHJXA/OsIQ:fnyiQSohsUsWU9BK3PQSohsUsWU9BK3W
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1176-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0005000000022f1e-2.dat upx behavioral2/files/0x0008000000022958-6.dat upx behavioral2/memory/1176-1520-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp 71c39fca938148cf0d415bd4f7bc5260_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
- Size 139KB
- SHA256 e63cc5918926397a8f83d5c0a18d33ad77e279dcd2c9a34a1d1554fbc9b2e2aa
- MD5 94eb2d420390a217897bcad8fce63524
- SHA1 bcf3e588cd075358773ade7fad0f4ce78d319135
- SHA512 32a6f920e0f0d3b02a5f55a2cd90853fd81426e9a7d438a630ed94c9c78fd0b1b5f7dc4c605fb33bced3618a217191cb04488be32ec66039d93822e64f764fd8
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IbTWn1++PJHJXA/OsIK:fnyiQSohsUsWU9BK3PQSohsUsWU9BK3Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 237KB
- SHA256 e6a9563121bc632d59cbc233596663a2536f2b914d4b2b0e14de2bf0166b6966
- MD5 865b506800559b48781066c5c702b5c0
- SHA1 acd21c4761400a026b2825b6773430c4ba947dd8
- SHA512 aeb858f0d33a7571723eb41701502dbe906bc15203bb3e29cafdbd13b1d75a268364e0abf6e8ab8478f8bf6d083d61376c1f4087e91a4eb69cb64baf73f3959d
- SSDEEP 6144:KiQSohsUsWU9B8QSohsUsWU9BiIjNDv0bNXkbvLk:VQthsUsWU9B8QthsUsWU9BiIZGNXkbvI
- MD5 SHA1 SHA512 SSDEEP