Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 11:09
Behavioral task
behavioral1
Sample
77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe
- Size 72KB
- Sample240613-m9f84azfpl
- SHA256 1d6d9f5cf6df8364a59e1270f76056ae687c8a8e9f8c7303e1a11849147ecbd0
- MD5 77027581a30d8468b0ad9ad7566bac90
- SHA1 844b469c923e7d53114104774cb22a196fca82cc
- SHA512 4bdda4c1d7e7ae714313d12034ec3077c8ed238795b843d1c1f27e2cbfa05a46684d8facb0eecfbe051ebff3a3c4be85d696b38ba4c83a73545e2150b8848e54
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXD:a7ZyqaFAlsr1++PJHJXFAIuZAIuE
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5246) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1856-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/1856-1964-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-convert-l1-1-0.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 77027581a30d8468b0ad9ad7566bac90_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 73KB
- SHA256 9331463088ad734556c986d4fc96f6a2d1a9e590561ac8f6174be27f982c70c1
- MD5 5cc95ef6285e6c8118fcb81a6ffbafc3
- SHA1 6e79d68ad0845ecad56367ecf96f4eb14600c3ee
- SHA512 5ba0ed3bb51b1ddc022f34a583eec304dd1281ee59a1b3ec74c7668e7004cd655c4c6cdb284857bb9830edb7d83d1162160f7320696c4bbb2777e66f37834fa5
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXz:a7ZyqaFAlsr1++PJHJXFAIuZAIuI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 171KB
- SHA256 480348574b477994e784b5ba8158323813f761437f11bfcea2c148d41c5b8c47
- MD5 ba1b4253a0f477c5cd6c5c0f9a32d733
- SHA1 1d8e05feb475a6b9fb75fb944187243206bce1cd
- SHA512 d69ad7707d9b83a8a28a4f5f5c89e29859c5d41aa33de676a85e49daf5fbbcdb7eab248100a9194a1b32d659d6fd32f4aca2dbcbcc4ff78269bf4fa0665ca734
- SSDEEP 3072:enaym3AIuZAIuKWHIjN3tj6qnv0b2UrXkbvL3:wHm3AIuZAIutIjNDv0bNXkbvL3
- MD5 SHA1 SHA512 SSDEEP