Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 04:48
Behavioral task
behavioral1
Sample
4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe
-
Size
47KB
-
MD5
4b2f876e5c2b4100422ad6cb704950f0
-
SHA1
c955218b2d2fc8a2e7c1d8a9df8f4d339caca52b
-
SHA256
029761fb53ecb2d658ade9c08ddf7d5a5559c0f887fc9a57517954b6ceed7914
-
SHA512
7bd83adb4bf81856624760b09005f046b96ab5bdd745d0c61e5a42368e34b926198ebddfdce0950f1d7631af071ee39a382f533271b5cd7a4f59f9dd4ac060bd
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFWg:CTWn1++PJHJXA/OsIZfzc3/Q85rfrP
Malware Config
Signatures
-
Renames multiple (4101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000f00000001226b-2.dat upx behavioral1/files/0x00020000000104aa-6.dat upx behavioral1/memory/2344-86-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\fr-FR\sbdrop.dll.mui.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\ja-JP\Sidebar.exe.mui.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\README.txt.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\EDGE.INF.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\MsMpCom.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Mail\oeimport.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBE7INTL.DLL.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\triangle.png.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\THMBNAIL.PNG.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows NT\TableTextService\ja-JP\TableTextService.dll.mui.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll.tmp 4b2f876e5c2b4100422ad6cb704950f0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD56733c9f04f80defad52b4d79bc2da233
SHA1ef6b430679cb31408478a9b537e82e19617ec065
SHA256d383d44bae0eb6de81efda93bd3ff437a9b60ce968a0ccc5facfdcaa7e8d5016
SHA51242d6a4ffb79ed71269a2bb0803d0452826dddbc834acec0d5e94d847d02e6d3a4c34bc50018f4bb5f2e697002a91e720fec3d9af017df6420f3e215888c4e796
-
Filesize
57KB
MD5fdd1e8c6c95928ddee1276aad4e1aaeb
SHA16d35f4275162ffc6554709ac644a01742d09b2f6
SHA256d9f93cd8ae08da951cb53e14e3de2608c195459477646086c1d7d1af1c478513
SHA5124dcd9ca9692186fcc76b8db4a76b9a599a4b22adf4486cb6a6e4906d4b8e36488aad8ff2aa2063fe1c7170b3943762c90547b4ec2f22c7bc9e092bb86a436c98