3ee72d2a46b16b007fc31a5586d50d50f65451482461fdcf9f995e717633c27d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
Size

93KB
MD5

86dc41d03f622705140c7b6a71967fd0
SHA1

d22314168952740391b70c934418c2f5323a45c5
SHA256

3ee72d2a46b16b007fc31a5586d50d50f65451482461fdcf9f995e717633c27d
SHA512

a4e9be4a7bdd3a4aaf6227866cd586a7c9a9f2a55422e5e6a1686481bfae2c2683843c742ebf8af9ae5aa1a8c8a2a6459b768f89dbfd926c633d0d34655b0692
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP76PDn+I+9:6rWpcOPxPke+e3fFpsJOfFpsJbgEODm

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (927) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-handle-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClient.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\ReachFramework.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsFormsIntegration.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.ILGeneration.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationCore.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsFormsIntegration.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Intrinsics.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Serialization.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Xml.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.DiaSymReader.Native.amd64.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.DirectoryServices.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Buffers.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Design.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\ReachFramework.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Resources.Extensions.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp	86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
93KB

MD5
e944d1244fd79cd18f20f87d670e06d7

SHA1
5f10884bbb973998e74b2934545525d632c90560

SHA256
3f8c649926bfdf8552b0132d9ad0d78baf53d60abfc6debf271aa8aba6424b9c

SHA512
4218e8651a7f30af4342aada99022f7e9191489e2d2a3bbf05a1046e2806945fdcd64e84fa6e342ed003a47a6d4df8e32f5bd321662cff80ef8d38869145c5c9

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
93KB

MD5
3231f03b57b752581d90b790e08acaee

SHA1
1f19a96540f069462345f64d36c18adee3fc4856

SHA256
ea3081836e5ffc75ea6d8d8bd330a169b9750506eb352714c7ed422592cdeeca

SHA512
9e801a53094e20aae865e849ed704945552c5954b8e38c8ed34349887f9a996e4fd7ede00781b940ed6720a0c1a154463aa5e54cb14df224cc5f116277545190

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads