489dfb282deab3bf8d70c0b00b2a84f6e02beb5b6979637666133b7363858598

Analysis

max time kernel
150s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
Size

77KB
MD5

0b78e2030c132f0ab53265840f1af130
SHA1

23a877ccc374345dc38502559de2616e950728fd
SHA256

489dfb282deab3bf8d70c0b00b2a84f6e02beb5b6979637666133b7363858598
SHA512

07b617702cbf56f2235125ec83dfe58fce513e51c28748756cbc92bd9914fca9f5c41a10cb4ef677ed93c38b5f947896394b721f7b8db2ef10969f57f6303a50
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/H:6e7WpMaxeb0CYJ97lEYNR73e+eKZH

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4821) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\CompleteReceive.midi.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp	0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b78e2030c132f0ab53265840f1af130_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
78KB

MD5
c425bee51707faee2182efdad39afe1a

SHA1
2ce175a618cd7330e70537a63de171dd451fee56

SHA256
c153793514e766874f98b7c52c10f139c5886876e6fe44dd2817c798d4da318e

SHA512
8b8f7496abeacbd2f6384ad7b4934c10c083a2208c7d81a4c49aedccc37051d2c636b2c6f46ef102682803fc5dca2ad5288f67b6d753570bf23b570f6b1c5b28

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
425ca19156c2f5eb2757a00e8c29c3b7

SHA1
1e3245248af45e3e1db8dce604610a4c327a5c55

SHA256
274047f31f0b43763ff185e09597a7e7a692268e2686445b461716a4ee0dd664

SHA512
217bb9d329ce8bac88b24af3fe145c0d7edc0e15416d591d197d20553e3bbcad4c6ace62b49cadff058e4952d72816f61640b1a7f19439322976fbc7019682f7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads