Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 03:26
Static task
static1
Behavioral task
behavioral1
Sample
9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe
-
Size
46KB
-
MD5
9e998e2db856f0fc914b1855482fe4c0
-
SHA1
0444d8260bdc2df0e72cdb4d2bfa406a7dcfa422
-
SHA256
540c58b0344f9538724c9c683b00be871ad8dd0a1a1b30fd9c9636cd1a60fe03
-
SHA512
382f445a1158e7af7e2178b5859db748960e860c7e84b16d0cd57daf90c360c9e11220fa603014fa1e7d2ef577d79e4437d6bb81f4b12c7570df0f413275ed20
-
SSDEEP
768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcd:/7ZQpApze+eJfFpsJOfFpsJQ
Malware Config
Signatures
-
Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\JoinGet.xltm.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\vi.pak.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e998e2db856f0fc914b1855482fe4c0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3932,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmpFilesize
47KB
MD5d9588d6971725a8262715c227e22a985
SHA1d0dd1f540f3c30645675a6b624a8977c34000b5f
SHA2564f654b064789fd601a64d26d5c664bf5e85d64c161065efb02f8cbc2f82460f7
SHA512cf962009655423de95f26f0d158764ac17bfdd9b41adece50c53787ede3db882e62ddd9c7532317f33a05aff029d1c64e21aa6f32de2de0fe47584dd7bd92399
-
C:\Program Files\7-Zip\7-zip.chm.tmpFilesize
159KB
MD5dcbc7d63f865f670f9267865291ea7ee
SHA17298b5c2b66aafb5518a4df39ffc455c69547439
SHA2567e5b25a2ea58f04a85854b5ae19ce59a7c97e195beba7cb205fc2bc8b6960219
SHA5129a9a13e4e5d852978b30a8e4574184704425b669bdc565fbb517268fad10489ef236cd041182d3a08285daa2a4e1e0ce3b88e9a60c6e35c30b26a1724b6bffa4
-
memory/3492-1-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB