Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 04:32
Behavioral task
behavioral1
Sample
4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe
-
Size
114KB
-
MD5
4919bebe9f5de22b95aabea2959df730
-
SHA1
b994cae414dee862eb44939800f0c7fda93ce222
-
SHA256
8ad3c97ecb1966015416881c846f7603bf9647645d78ca335ec360b6fd072041
-
SHA512
c6ba4f952b3ec7722f5740f2792f253565c54b759c86c3962a7c208bd9a6436b374c2c71d28e84db6276541818e6e4a3fabd3048913dc7693cdd633af5c6733d
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8cTWn1++PJHJXA/OsIZfzc3/Q86:fnyiQSorQSod
Malware Config
Signatures
-
Renames multiple (4821) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4500-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002356e-2.dat upx behavioral2/files/0x0008000000022aad-6.dat upx behavioral2/memory/4500-1710-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\dotnet.exe.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp 4919bebe9f5de22b95aabea2959df730_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD54cb80e91057a71097f167f6f1adc80a6
SHA1783941f2f213ee94d9fd9af4b058679692555327
SHA256c189b5d3c55a76c304c7a63c2173ee315981720048cac007e5724c7d5ecc80f1
SHA512c200374303d525e4c58bf883e5127f2e0c27ebf7ff5c89f4e4aa25be42e1516359d79a6a46c8ff4a9cf77af6e884517143302266086c74971b71a6bad6446dc7
-
Filesize
213KB
MD539f56d4ad650ad19f2644e4953264480
SHA13a696a1e2c16376675ad55c67743ae22e524e9ec
SHA256beb5b37903585405147d782f235fea1cf1f3a9df975d917384b938e9dbd57a88
SHA51214ccc9e992fcd2f9c0de407ce900fcbb97a5b4dd7558962e5152bdcc5dc28280441f3edb9560e2a111a7678dc287c160aaa5ca1adaf4c3d17d1a6f2ada724a17