Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 11:12
Behavioral task
behavioral1
Sample
77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe
- Size 142KB
- Sample240613-nbajbswejd
- SHA256 ebe46e9c7660239ffae9262465bfd4cfbac61ccce4ad1e2d15bc8b2f7ae26318
- MD5 77285fb68fb02ea4325a584ec2538340
- SHA1 68c6700a604de29ad5272d05f5a912340db9f2f0
- SHA512 f0fe10b597c7c086d77b739493df330914e6d71be19c05b299fb7d81b368d65d1227328cc1a3246395444ef700097e48b501e207812688917bb6a0b866b454d7
- SSDEEP 3072:fnyiQSohsUsWU9BK30QSohsUsWU9BK31l+:KiQSohsUsWU9B7QSohsUsWU9Bt
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5016) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002328e-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/4592-1784-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ar.pak.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\external_extensions.json.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\HideTrace.vsdm.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp 77285fb68fb02ea4325a584ec2538340_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 142KB
- SHA256 db2cbb2dc0c4d4a6be2a55a8b194375938751d299b4616a7018bd9a6941f1c83
- MD5 35e32ce631fd9ddcc9f7e2e782dafe13
- SHA1 26618f1b215d5c92cf9f3db4b3003f609eddf6ec
- SHA512 c2a40d67793d8358f986516ceac51dfeb4a4e07836f9371d39967fa599eb6365b5aace85541020efd0a882a51bd6b00b491fb5a1cd2e0c282869780b5497adcd
- SSDEEP 3072:fnyiQSohsUsWU9BK30QSohsUsWU9BK31la:KiQSohsUsWU9B7QSohsUsWU9Bp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 241KB
- SHA256 02a26a28a0dd089cde72764346948789a7052b62ead5529d96cb4de6cd4c9b83
- MD5 49ae68c50629c1e2ba6e5f863187c7d5
- SHA1 4bc86bb4a57324b400743f7f98ccad2c7ae20a5f
- SHA512 1f9910ad88f547b369304dfd9613468af3ddd70f597b67ceae10667aca3c0a2e8522ac075848eaa0656b5894c228448d3d90531e5981dc1a098039ec764dacd9
- SSDEEP 6144:KiQSohsUsWU9B7QSohsUsWU9BSIjNDv0bNXkbvLw:VQthsUsWU9B7QthsUsWU9BSIZGNXkbvk
- MD5 SHA1 SHA512 SSDEEP