47632db62756e788dfa79c487d82aba76362748f0f7a6502ef4d301afe7b2251

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
Size

95KB
MD5

0101e8bd91eb75a3de3ab5ba5d420c00
SHA1

2ef0a43dfadbefb4be8535edf03f62aa1420d673
SHA256

47632db62756e788dfa79c487d82aba76362748f0f7a6502ef4d301afe7b2251
SHA512

e68dc46bdd68119d4a16262d68739650934298849d6764b48a284c58984c453a96a833ac95120dca981b56f3330c23907b02747003ca3480b582945798dacf99
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP26n:6rWpcOPxPke+e3fFpsJOfFpsJbgER

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0101e8bd91eb75a3de3ab5ba5d420c00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
96KB

MD5
b85319339162b93a353c34628eedb2ff

SHA1
6c7ad5e5c548db1c9c074bcb2e2c471d07ed1e8a

SHA256
c3d46b70f1a1a1a33449e77af01c129e9b333b7232d7f517c24d18f1c648b49a

SHA512
353fdebbd277cda1ee698e245293168cc7c7181d40c1382ca1205c731d76717e251205872e51ab8c57c3b7271f621731048e6094beca6f3e1f358495957801e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
afcc3e67058c73f45b6ff15c54262bba

SHA1
28cf60a710cb34e2a86966b2b099e639f3a6491c

SHA256
b7918d233b4ac8a36cf01b4760206f7f55b110e545661a3f4b46ea4d9072728d

SHA512
d7f3893d96c45ead17eadfb6a22e9a055fc630c06357e442acbb38e9c026e1525b6e7093edfe461e7136fd5665d071ff110862887043fee51253981fc1ab90c7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads