Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 08:55
Static task
static1
Behavioral task
behavioral1
Sample
6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe
-
Size
97KB
-
MD5
6e6abe0ed3fa07d643bba842ce383060
-
SHA1
f1afef4b06d887b21a69e7e2ed0ac6aeebdc9155
-
SHA256
e7a1606cae998e23061f56b693534ecd48a3ac4cf13e732c6f329f6bad257040
-
SHA512
6af43d771247e8a0d8c4b511756ac18ed8f36135f4d0522112c10a23bf9eb0291997767468a1027b75a4ad6288f3456973902e8407234b20eab11bee8658a952
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/DMQBr:6e7WpMaxeb0CYJ97lEYNR73e+eKZ/Br
Malware Config
Signatures
-
Renames multiple (5130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sl.pak.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\7-Zip\readme.txt.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\desktop.ini.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp 6e6abe0ed3fa07d643bba842ce383060_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD51ed3266e3cb1791091bb9e094f805ce3
SHA1a01f3459286c80289d80d413aefe6e356695c2ec
SHA25647bfa204ced62e3b037bc2940b1c4b23d60b0693fe93e0f0d5eec2bf35ded368
SHA512006755ca05b83764f4c74f1a0644f7d26699a01e72e872d08a4dccf314545f23f794f8601b0feb9e6af9b2fe4657200997f4b525fbe2e6dd3666b994e7d10fbe
-
Filesize
196KB
MD5ae3c5f9aea6d057b1b6965b26ccbe78c
SHA155784c9cfbc9ba443b93a27f091b8a8d96ca6799
SHA256e1d33e6038169cb26fed5f7becc7f34963d055b6f4ffdd90c26d05082fbee30f
SHA512cad3548ca064df0c44660879fba07ff7cbb51473d26aa40a1a0cfd6af2d5a4ffcf13dfa92df21e654ad9da3fd3d138ef252b0c02b77761955d4a05c04ec529ac