Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 01:47
Behavioral task
behavioral1
Sample
cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe
- Size 359KB
- Sample240616-b7rfhaybll
- SHA256 c5b4b1c983b5b508af136b6058105c4f01cfd5843fe27205d645e32299fbe5e1
- MD5 cb0581b3d7e7e3bb1cef6dc53d7655e0
- SHA1 9cbb1207bbea18b8be253a0bdc0b58fa53e9ba7f
- SHA512 d72b1df1fc16c4c8ab5b356e4d6c0d0a86af89191a31d24639f0cccca7c02800e771b582486e2d26d950f73779a98f2231d121c7d460b55895c5d69294d691cf
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIuMQSo1EZGtKgZGtK/CAIuZAIuj2x2B:VQtyZGtKgZGtK/CAIuZAIuMQtyZGtKgK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2644-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002328e-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/2644-1446-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp cb0581b3d7e7e3bb1cef6dc53d7655e0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 359KB
- SHA256 b804e43428f59957f81d8946d39973d642686df77f544220dcace45563bd41eb
- MD5 3203e3d128deead28400016b0fe2507e
- SHA1 427fce51b712b050ffc46802b9866ef2fcba1cfd
- SHA512 8a3822c74b03c9c0ed7dbeef94beb83d207340118830a24f0598bcc784f2c643af91d03055a4597226d60d34c067835f55664849b6e2ae40c4e922964c80449d
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIuMQSo1EZGtKgZGtK/CAIuZAIuj2x23:VQtyZGtKgZGtK/CAIuZAIuMQtyZGtKgw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 458KB
- SHA256 52baf3cfc61bdbf6e96b898a668b1d5d67af35bdcf0cb0179430b1631a46b85e
- MD5 233410a50caf706c190cce4601e15249
- SHA1 8c64313fa825c50a96ded103a61a62d87bb3c19c
- SHA512 412a14bb2c5e41a9958f4353de1025b0a10424f4921da47473d0d01c638086e5f71388e061bd0dfe1f9e1aef03f0612044b6839d5263d92e88426b9058f4d61b
- SSDEEP 12288:VQtyZGtKgZGtK/CAIuZAIuMQtyZGtKgZGtK/CAIuZAIuygNIZGNXkbvLF:VItNItTgNIZaXkbvp
- MD5 SHA1 SHA512 SSDEEP