Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 07:31
Behavioral task
behavioral1
Sample
6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe
-
Size
435KB
-
MD5
6205543a6e5099fa0ef92529861d3300
-
SHA1
066b8bb23e78c65af86f44a6e8dc057a6f92f03f
-
SHA256
12f7a6aa796a8f13c5842fc7f160643692d55765a3f2956362b5d4822ea62dd7
-
SHA512
1fd517a47120da3fe8f4d79293f80e2f10f696d2a4c8b09798bbfc86aa8c39d999985e79560271055d221a649862b4762ee6645fe5179fb4fd8f507f9cb30e96
-
SSDEEP
6144:KiQSodvy5yOZZZZjqYWI75NLIZKcuBHZZZDGmmmml6RqSWOEmmm5NoBmmmmmSDyk:VQtbOLEgqaei2ZPr2Iya
Malware Config
Signatures
-
Renames multiple (2625) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x001000000001226b-2.dat upx behavioral1/files/0x00020000000104aa-6.dat upx behavioral1/memory/2188-372-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\nio.dll.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\flavormap.properties.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp 6205543a6e5099fa0ef92529861d3300_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD52a4d769888f9c51cd5785a61f7da778b
SHA14e953430ed3120c524536aefe9869435970402ea
SHA256b1f65875b81d4ee32a6dea2d69fae79d8aaa35f62138a934b534fd82cb58fa90
SHA5123c0f35aa9fb2a9ddbd160842abe1dd09f6763a2eacc73cfbaa01e92b061d96e159ea1a5e3ea82ba2b9046ccd58385574ef1b1a2353b6286b7ac7e71d520c0328
-
Filesize
445KB
MD58f8c961ddef1941ff642ab1cd7ef693c
SHA1e2fa0c737ff4c8a688b98b8acde3ba90f199f6f4
SHA2565fbabd2385901c9a9cba2bd16706348d185476ed9625f3dd085bed6ec1d3def9
SHA512f9a3961d8d83db494c41b1ff66691be44040b97233ac66979f44cd474888ef202c449a78409c24682dbffed2ff2d945d9d997b2338fddccb0e97fd22829682db