Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 01:33
Behavioral task
behavioral1
Sample
ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe
- Size 68KB
- Sample240616-byv3bstfmb
- SHA256 c0aa7d818cf7c34c6ce50c0027d8ac33aef6974523a8518a56cb75b429c4a9c3
- MD5 ca18fc53e019bd879d2a7f071ccdd7e0
- SHA1 66e8055abec8f9aa582e26eef906629be9c49ecc
- SHA512 73f6cbd27fb7678ea877b0547966b260e5a0bf4699417e9b1a4b12aa1f73d121a7832b2872d596ca5b500d506e5644be54b44b9c3d70e62e3984832cdd29e4ae
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXV:a7ZyqaFAlsr1++PJHJXFAIuZAIuK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4560-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002328e-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/4560-1888-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoDev.png.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.tree.dat.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\release.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp ca18fc53e019bd879d2a7f071ccdd7e0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 68KB
- SHA256 d27fdb52ebaca5ed3595ee2e6d2fa847fb6abd550d7dd10f3214dd8ca1971db0
- MD5 ec3a8e880c6522226db2d19ce2165f41
- SHA1 0a562d3488cbb3c6db00f11349659151aa1cbbe2
- SHA512 f9e9a5dc8f3cee0498adb3d68463a09c088e541ae28f09d32791e421bfb5b93c55e3aa6d48c5f7ab3bcefaa8582f04ca5005f310a48203a75d766eb3f549df88
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXF:a7ZyqaFAlsr1++PJHJXFAIuZAIuG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 0223b91acb6915039e11dfe522956733033f2cd29ec17447fb7909abaaeafaf6
- MD5 5b80fa1d1798b8e041d4a8e574ca4611
- SHA1 dc252d658165b1f8080e9cb63808bf38916399a3
- SHA512 464b39e40bb006cfec483fbd68bd2317fd2017b88cff41a505de834ee1bbe7b8910bc30ae1c05d642134dbddf886992af61f04120b8794afce9a39fcc0e45815
- SSDEEP 3072:enaym3AIuZAIu7WHIjN3tj6qnv0b2UrXkbvLK:wHm3AIuZAIuoIjNDv0bNXkbvLK
- MD5 SHA1 SHA512 SSDEEP