Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 23:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe
- Size 87KB
- Sample240615-273fwasfmm
- SHA256 e4b8ce07dbe31abde149a0f86e6ec2b12fcf99f9b6ff2eec0e17c91bfe7c9ce7
- MD5 c1b4a43c216a76d7547cac324b954e10
- SHA1 9efcf7ca5ac379d0e4f88fde3baa9b96da0741ca
- SHA512 8e1442992c959ee2cf284baea44f008dc2d5062811507b3f14fdcd19c58bcd511d782ec4134df2f2fd577c7078dd3ec03efca0734d236ff8298da13349988382
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKY:69WpQE0zp
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5126) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp c1b4a43c216a76d7547cac324b954e10_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 87KB
- SHA256 4c0702f5610fa2bba9a0db3e37569ac0fc38e1d2815f8fcc267d62c9dc5eb61e
- MD5 fc947d71fc1620734cfed112cb9e0b7d
- SHA1 90ada492bf3bac51b9ac0778823523d7b8bc5eb2
- SHA512 a49ccf5a4315e3b832cce70d7a342f1f6da2ad735635da2bef0ac6979c8c89ae8fef46af98d27610cc9d7ad0153daece7007aac9a2ff08be764f4ccc415c1692
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKD:69WpQE0zy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 186KB
- SHA256 5313ce049a20dd581ae294431902268363ccfb8e3fedd8ac01cc1cd9c9e21c4e
- MD5 1cef56e1fedd9c99410acb2e0634263d
- SHA1 f1f05c6e2ffe4c97d3d15c8e2f33fad92b66b5ac
- SHA512 1a1c9948d00710144f6868397bec3634dbc3287199c6ac02a1201a6e8dae8c7147c6a6730ba73a35389ac3a50dd58096b3a4b71d92cf8483d3f5fa688749cfc1
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKB4pWHlPEXZzjUq3th5f6utM5vLNiG:69WpQE0zvWHIjN3tj6qnv0b2UrXkbvLe
- MD5 SHA1 SHA512 SSDEEP