Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 04:50
Behavioral task
behavioral1
Sample
4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe
-
Size
211KB
-
MD5
4ba9789a0d6ae00bd5516766dd9c5460
-
SHA1
88a423811af7d06540438a90cdbf060c6a6d4549
-
SHA256
fb870e33245aa45e14a0ffa9bd62b04b28c23ad98a8acca970f9f4a4d03b17ae
-
SHA512
6f19aa7248023d9ea904408814767ee5f81d7b88c0687b3ebd4c360eca80eed5c8b902ab7521645d1e269ea24d82bb7e28ec92093462bb47f73b184138a15a56
-
SSDEEP
3072:fnyiQSoXE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Exq:KiQSo095pK7ShcHUa1
Malware Config
Signatures
-
Renames multiple (1371) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/652-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023237-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/652-430-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Primitives.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clrjit.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationCore.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Extensions.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationFramework.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationFramework.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.Client.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationUI.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationFramework.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Xaml.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Uri.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.Messages.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Design.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemData.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.IO.Packaging.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemCore.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClient.resources.dll.tmp 4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ba9789a0d6ae00bd5516766dd9c5460_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:4064
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5dbdfd4bd9b200b9ef348a214f9ae592b
SHA19f789eb6eb964849274af8448d129b72a642c7c2
SHA256018a0c41e43601fbdc0ffc19d35a4cb685059122d29f40cfb1dba08882230559
SHA512d7b61b6151a27daf1e52faf0f5851f2e464ac8988bf9ba75db1047c7f5a94781586c1e00d22eb7dd3bcbd6567105ee8d95f8453b341b7dcc280ce43736665709
-
Filesize
211KB
MD5ac74bb648d1ab2f64aa0d583f70a1b70
SHA1b2c5427e2765b1baf24a309bce0440fa71df937a
SHA25631920c99514d8fc598aa21e6ac89dedb2844ae02c6b5eb479e6c0012b3f9ef1b
SHA5128083523531aa5322053c33be9944c6623cf2620e823ad92d02fcba0070011196b32cbb618daf3b1706f8de6fe65e78354410f9de8a4a42e25e79fe943f7b77e2