e4be014bbc785ee9b5fcea8c7f37958c219ab9f8b7bd2f2e762430a4a44563bb

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
Size

76KB
MD5

6a90ad263e0959d82ed4d0060fabef20
SHA1

0e062cdf838ecea18ad16d86747bbf20fad03f82
SHA256

e4be014bbc785ee9b5fcea8c7f37958c219ab9f8b7bd2f2e762430a4a44563bb
SHA512

f2e770ec3eafed4da8bffb0e6c94e06f15389550b34a236ba160e85ebfffe4dd9e989009ed870e8dd327b19ec7d011dc2ea4252116af76423b90b943df595ec5
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YWtMQQQq:6e7WpMaxeb0CYJ97lEYNR7Ztu

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5022) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hu.pak.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a90ad263e0959d82ed4d0060fabef20_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

Filesize
76KB

MD5
548c338b5b2616ec4437c41f43bc7e8d

SHA1
3941ebc25a9b5034dfd3470a59758178f0e26fa3

SHA256
2d5a468383edb498263789c186055aa846137050bd47c21485b0140dbf812dd7

SHA512
bf5e9ff79a98f60661542497c1a9272f771090bf10c5e4444c1da31295e19169981efe5a6feb1728494c6ed0350ab9c3fbb004e5f19b2c8905e7b94c74738c33

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
cf248ea6975a3f50bf5ec57929820fef

SHA1
382b92bbcd3f58f9bd12141ad4b22c5a3787294c

SHA256
7c8c15553bd13db9473ce63361e77e7ccd5932307c70658c961923460d7a9335

SHA512
e8e3cfc1520d8d48f95487fdbf13f978df03f92e347cb411aab835288155c3ad656e341ac6510c0f3560ec3ead310bc8d272180599d3b8b80446c4080e9ed2c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads