Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe
- Size 80KB
- Sample240614-a72e2asbqm
- SHA256 c829ca177554fd2e11a78b6a3d7b16845311d4826098a1cf5fade5cbbcf68f09
- MD5 9508c6b25e63a5bf57331534ceb85e50
- SHA1 92550270601389bf1f03d00298d803c770d9e9c6
- SHA512 314eee72067f29a2de55e2f7fc97872c283554378317d42857f0d379aeeb38ee70c4720af282e2a09459d18d633ebf831bee0ceb0526b03365ffd8cbb941e16d
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hH6:W7ZDpApYbWjIlE77ufL2e+efZwZ2A7Z
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4876) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fr.pak.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\LICENSE.txt.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 9508c6b25e63a5bf57331534ceb85e50_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp
- Size 81KB
- SHA256 fc3d095295cf35d3041574dc07539c5a73c6ae1f875746633d14acc106c41f59
- MD5 939329063d1ad12fb50d29d540699595
- SHA1 9d716d8b12e5ee9c933cf50247b7a5adaac0f2b1
- SHA512 8e3b356f0d794137188451fe9256f34cd268c482d0465cb4ca6751f1d1fad246b19b1f9292278812753ed678486f3fedf20d7040d64adec3c4bc7091833959e9
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHH:W7ZDpApYbWjIlE77ufL2e+efZwZ2A7A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 179KB
- SHA256 b4e9c851239c5e2648a218cc8ec85f3f4a9f7736d4d4c373e8790bc3c88a6dae
- MD5 2bc0d4f926b4320bce3b1e69ca4fdb6f
- SHA1 320b75f190729d428c2f7f43d970d2ae03602d63
- SHA512 56e49f44bc66133027426ceb71b3b2ec27b88980b1b6267de28e393051b3fbb907a3ec9b4bdd160c64d0a6d6ca5e3cbbd48eb1b8c0b0b818e30153a46b404f85
- SSDEEP 3072:6DWpwE7oL2e+efZwZF7iWHIjN3tj6qnv0b2UrXkbvLH:dN/e+efiFIjNDv0bNXkbvLH
- MD5 SHA1 SHA512 SSDEEP