Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe
- Size 44KB
- Sample240616-g8ar2asgrc
- SHA256 4d7cc927d827eb8573a9d7317b6912e61f582f4a8d32ff9d0bd5da877f40b9a4
- MD5 dcc5a52f38b8d376e5f4ae4a8f404760
- SHA1 6a9ed4caee74e1bbdc791136e590d88d4ccaf09d
- SHA512 5c1f38edad688673823f54cda0e43d790984a3ceee26a62a9df3e71acfbb2d039dd4383ec9f5f2d08f9611d61af3dbcc42638d1cd9584a709439698a319242c2
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDCF:W7BlpNLpARFbhblkYlkuvIYFWcDYcD4
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4927) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp dcc5a52f38b8d376e5f4ae4a8f404760_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp
- Size 45KB
- SHA256 2025b943064ed2dfac1fc57557f9b34d4277de5dc11d2f1148651d4ac4af8a58
- MD5 19748ba4235e61550fb3155d9548daf5
- SHA1 ac295bbef62b643d6cc18d493e02594a29deac23
- SHA512 db74f5a206f980da7c84fa5812e81f95aeb4d57795bcd851a4a5dc2e25fb0be8d28fb6edfcc5271d3be6331c7486292ae908365adfecc4c79501d01071d6fe3e
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDCF:W7BlpNLpARFbhblkYlkuvIYFWcDYcDE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 143KB
- SHA256 3a4daea3911f2ee694bcea284c1e027c9fb83f8ba2ba06065124403a53dfb3c1
- MD5 dba07d506e80523bc8ac146840df7687
- SHA1 1ed0ebcea35d39d902cbc5ce2719479945065dc3
- SHA512 da272f48571912434a9999a4bcef7d2a5fa2b434b1b4c16425fa3fa1d7cbb360324e1c0250bb14612bb9bb2a0cf1e5b1fab37e9b4a579f44bd73c6520c15ae48
- SSDEEP 3072:6NLWpCZLYFWHIjN3tj6qnv0b2UrXkbvLk:u6SYiIjNDv0bNXkbvLk
- MD5 SHA1 SHA512 SSDEEP