43fcc4b3b20fa98b4e69890180bb29eccc188168cdf422b534c2c3e3e4b3625d

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
Size

112KB
MD5

d53982c3fff95296382501f76d1067c0
SHA1

b3fc59165bb5ccbceff77eefec85187519d49c07
SHA256

43fcc4b3b20fa98b4e69890180bb29eccc188168cdf422b534c2c3e3e4b3625d
SHA512

603c9a21f53d946cf8bc3b5a49fdd8bceb6229e201669e59e6540b80011bbd7f11f1b8f660e9afa28f39144d097056e9764ca9e4191b1853ff8447a16c3d1c3d
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzg:RqlIyFESWu0SWuGSM

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4849) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fil.pak.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoBeta.png.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\icudtl.dat.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\id.pak.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d53982c3fff95296382501f76d1067c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
112KB

MD5
13198bfc62a5c1b72330750468bfaefe

SHA1
72860225a8b3579f919787fbbe181f04fcf5833d

SHA256
dd72e1b90b246c948c04c754231fa0568b3f2088c49cd81d0d2bdd4b372d811b

SHA512
0c40973d6206b9352ea391079841948c5072d16950f745b1581e022e791be75ade4220255bf7aa621bd7a98b17cbf0574e59ed26fbc8ed5bf64a3cdcda3bfce3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
211KB

MD5
61f59671c74ddfe699ac50fbafe3b0de

SHA1
98ba80268903ec772656c20aa7b7f5aff25a5beb

SHA256
cace9c8a0eb7a92a2249901bacb19fc57e12dd603784e64f52b6a6904d8ba4bf

SHA512
90d725f1b759bcca1d465c5a5722fa57cc8f4fe02b590730c934bffce0203c188e7bc8d785ecfc4295aec7db316c0020a85ac5c43bd4c951fb79cf4c2837f69d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads