Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 06:24
Behavioral task
behavioral1
Sample
598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe
-
Size
75KB
-
MD5
598b973af9c6941a76fef2ff689eaa00
-
SHA1
720b1f28c45810c4b5eefa8a53af7c0261db26ba
-
SHA256
7417ec430bd2e37df96676d2171c84c852216b3c46dc529631c1f5a6896d1fed
-
SHA512
98161ac1c82ff6ff6a7f7fc62fdcf94d9f4cc2305a4ea7fce10b3472b8a5c95a6ff48cf9cb8b341c6bf22e310f61296bf2db9a37c4feb0b99b2228fb2ad59ff4
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8s:fnyiQSoP
Malware Config
Signatures
-
Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/220-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002353a-2.dat upx behavioral2/files/0x00060000000168ae-6.dat upx behavioral2/memory/220-1926-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.exe.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\LICENSE.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp 598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\598b973af9c6941a76fef2ff689eaa00_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3468,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:81⤵PID:4756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD585262b8c456c75c9b6309b79a999efa3
SHA1f4c8519758468f2e89b216118002fbe9fb274031
SHA25645f3bb3c09e516f28f13fbfc42149bb69569b798c0ce48dcb9e5c00e21bac872
SHA5124eb0f1deeed2f5d1748a2605e5319f399d9e1f8bd6abfe7a0efa16675b7354c595316f6d7b0421c90d6c335d75603fbb4109a13873aa00be0c35c1bd528b846b
-
Filesize
187KB
MD5ba9b7ea7f2a1365cd3f23f92c407bfab
SHA1deb77a94d22c7e7be7eaa9d0d2aff53b0d81f690
SHA256363f21923cc222429cb9a8650159a94af0b90cbcd1852828b227c006dfc377e5
SHA5125dda7ce7aea659b29a3e1b7413fd371e4373a14d077520fb2444d265d8a84314430db4ab98caa5e4cf79a2bc2f56d2c09f012073db3e1d360d919307939e485c