Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 06:52
Behavioral task
behavioral1
Sample
5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
5d162b7afe6cc12b5497bb7e1366c7f0
-
SHA1
5a04b3c3ad9382461409ac6c654a7d9f30020a05
-
SHA256
fe2140b01839570b839b558515b05d662d3cc9cac87b3663f36553a9d55eafc5
-
SHA512
03ac17441c363315aebd180c8af99add5f88433eb3251aa248ab80ebc9a0270c299fc38862b2aff2f13e1a5334346ef511c795b0e403b65633785ad99db90dc7
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8FwQ/4mCB:fnyiQSoywQ/4mCB
Malware Config
Signatures
-
Renames multiple (1296) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4176-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000800000002325b-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/4176-418-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClientSideProviders.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClient.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Printing.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClientSideProviders.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wpfgfx_cor3.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.TypeExtensions.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.ServicePoint.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Handles.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationUI.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.ProtectedData.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationCore.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationFramework.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClientSideProviders.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d162b7afe6cc12b5497bb7e1366c7f0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:3984
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD51024bcf23ade26cf3f42a047545a80a3
SHA1675a295f6692350b6881a635000d424481159626
SHA256f826243160878555a7623c504eed5ed8fafe010aeaef5f19f34aaf801d431a21
SHA51273cae1762f96d2f06fc72c02c42ba1fac8eedeb8bbdd0ba5420d36c96642b42b2902a07b494c08fab0d5bb9f491c3998d622a7580188ed3443070613b7aaf36e
-
Filesize
90KB
MD5d00dd9ca38f2908f7286f061102697c8
SHA106ffea3e7abd8df2dd4489f2f19a1d6efd562a0f
SHA2564478ecc7ef7a3f09f749ea634127982878219d344cfb0853647529277d82c509
SHA512a2c2a99ce58e6b58553d24a73a0c5781fb2aac80666836f1f1b706c7b49d1f341d2b727218905972f20cb42b081b34ee2b41e42955a2b83226b1579e34bfdf3c