Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 04:56
Static task
static1
Behavioral task
behavioral1
Sample
a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe
-
Size
44KB
-
MD5
a40976b5441acb9163e177b462d75b10
-
SHA1
f88f9b104c4688a1fdb60e85148635e82eb47e2d
-
SHA256
4d5077fab12be489d18ffe985356420a95f1d7b1727a9d732df048f76360ace4
-
SHA512
7e1bf083cf43685665755b32cbca1bb7ec7fb5f16ed4ae57227794c68db9ff7ec4b90d66745a3eae0e32dcfb5015b638dbc65ffb216193d5d8b2bf9205379517
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDy:W7BlpNLpARFbhblkYlkuvIYFWcDYcDy
Malware Config
Signatures
-
Renames multiple (1358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\dbgshim.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationUI.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-debug-l1-1-0.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.RuntimeInformation.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Xaml.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-1-0.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.Json.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationCore.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationProvider.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.CoreLib.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationTypes.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Xaml.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Controls.Ribbon.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClient.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Loader.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.AppContext.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.IO.Packaging.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Xaml.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationCore.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClient.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.AeroLite.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Aero.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Primitives.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Input.Manipulations.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceProcess.dll.tmp a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a40976b5441acb9163e177b462d75b10_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmpFilesize
45KB
MD53efe00b8680fdc912af6b49c3eaba8ef
SHA1980210fae5ac9b6edbe4e92a5d5f0bbf5a535855
SHA256989768a0ac992ef09125f7c48b9a06c256bfa05aaf9a41465cfa62e12e26c5ce
SHA5128611f1d4d15a6a7985bd7e449d70e4b726832b96fb38707ab4e6b9d5ba53072fcf14980affa84985b3e135fa8d4b559a596ea87591f354470033606a55cd99f0
-
C:\libsmartscreen.dll.tmpFilesize
44KB
MD53d31c842b21f38ca35b3d43e6fc35b69
SHA10f25adcedaf19a59bfe679d677f9d990da24716a
SHA256a14d8311ceb32496de546ba26a8ea22af5490f6bb438d2a42b82b49e80d1b33d
SHA5122284752f16e5bd762f36dc03d47fba8adfa43001428ae6874fd8736ebaa36379f5e4f439af5572c80c2eeda23298e6d8bf3b41db78be99f00e6c1e1376bf5b5a