Analysis
- max time kernel
150s - max time network
119s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
14/06/2024, 12:11
Behavioral task
behavioral1
Sample
be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe
- Size 50KB
- Sample240614-pc2vmszfle
- SHA256 31461fca605d12fd02d4a6b2c3da24434b48fed95d3793cb5cd07505f653c8e1
- MD5 be61e60e97ffd7df6a69afc2a15fca90
- SHA1 53228a6e85f6618011042080b4e3b9b5d29415f6
- SHA512 2e897e7d8ed3d5283033e96003275a8b11a58c980382a5b38131c1ff47aa470c9ed14171618eb941f0a97181011af139262b397be572cd8ededd0a2a21192389
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzZ:CTWn1++PJHJXA/OsIZfzc3/Q8zxL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3944) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2020-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b00000001227b-2.dat upx behavioral1/files/0x00020000000104aa-6.dat upx behavioral1/memory/2020-86-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\PREVIEW.GIF.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.tmp be61e60e97ffd7df6a69afc2a15fca90_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
- Size 50KB
- SHA256 45cf373d7c15a496d341bf64215db15e7fc261b2fcc7a69e2b11718ac373710d
- MD5 7f8eb3ff903719d8bdd17343e0d38486
- SHA1 6eda5492cfdddc6ea3755d98034698dbb8d56904
- SHA512 fde76aa8a0ccc547ec427c891ba586fc64d1ca6751da2de0eb4ad33badd1619d20cd58199d614ca56a914805b21850cde136b6e1ef8fd52ee12db7e16e3a85e6
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzz:CTWn1++PJHJXA/OsIZfzc3/Q8zx9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 59KB
- SHA256 26b542ee81be39addebf673f3001f9d425eb34d2c8eefb5731b31acc053b24fb
- MD5 c9a75539ea64c1a65f80e78a1abdbbc7
- SHA1 1a509c3d6fcbac8057a527c89dd9c5f4e40eb8bd
- SHA512 6f19be9fb5cdf226fcb72b8ac329e299094c51b58cf85536ec94417c24df19e102a7ca684d514fb5a1c3573ea06c660df58fbd6cfd2f52deb62c27aac88f5d49
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzo:CTWn1++PJHJXA/OsIZfzc3/Q8zx6
- MD5 SHA1 SHA512 SSDEEP