Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 06:04
Static task
static1
Behavioral task
behavioral1
Sample
db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe
-
Size
78KB
-
MD5
db54a25d70caa3fa59b76fd7b13df520
-
SHA1
a4158ecf206b3c756a8b13598db8091133de105c
-
SHA256
26278f863b7ff76950b90623c1092e6851841908ed231d2123940f2dd12b90fe
-
SHA512
3abf4d7b706b78b274a17fbf12e0e8e8de09f08b5bf637e2f275287c25347b57beca4e26946de1bb8275438425a82f291863182e0b96abf9166bf1db176ddb7b
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh5:6pWpUFpEhLfyBtPf50FWkFpPDze/qFss
Malware Config
Signatures
-
Renames multiple (4849) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp db54a25d70caa3fa59b76fd7b13df520_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5c9a125baba056e8cfb5120d7b526493b
SHA10297df849d7464a82e7b57e2c156e4b9d364538c
SHA25657f5d4a221580563e393407b4f26d8ef5784efdebad116fff3520eb63f519ca1
SHA512dedb96694d53642cc86b92801e17474aff3c827e10a6fa0000d1d134dd4da6d92f4672390a5ac7267f46817e4c6536597e2839a92e5046477fac62f1c825e443
-
Filesize
177KB
MD5a06571df75895d16ab32e1a3de2b9375
SHA1f0e227ac084c9b6970dd3aac00b311006310eb10
SHA25642ac40288f5808b3790c7256ec23f06c607b9d24a6bb1b4b44cff9c32e79505d
SHA51284a655781eb77aebaff511eca63265864984002b4817ebb798818ddbcaa99d3a339fdc7d96ef1f962f248da313eb16ba575944548369a6c164eec72d5cc777a6