3c9542d93a73f4f7403e16e34cc12a76cd5a83f1908ad2c971c42b7b1b99707e

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
Size

112KB
MD5

87a0482be83dc9a299d4653819d29a00
SHA1

1756b9338a8ead5aecf00780ac0b54cfe1ca591f
SHA256

3c9542d93a73f4f7403e16e34cc12a76cd5a83f1908ad2c971c42b7b1b99707e
SHA512

3b82aa00dc964ccc05fefd212a92c81b2bbe5b65995a763707793b0a02d5c3e2770242642d7142bab914c48a5a9ee3adcd45a9dffff5c7adb7e929a29c70e51d
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXD:/7ZQpApUsKiXD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5022) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fil.pak.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\87a0482be83dc9a299d4653819d29a00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
113KB

MD5
bd58befd82a65380db68db5503556dfc

SHA1
66880cf74cd2ba47d82882b800f46b648da506a6

SHA256
b5fcc054f3f692653d667eccdbc7be3c4eb092c0e4270fdc127534e74a532599

SHA512
7a4cbda52d3a814c4a2996899fd236212fd1dd98330592e178ef5f75696af605e92506e17710400df77b5867e7ad33dfde76f3b48c246645e7269906c994c36d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
211KB

MD5
8e684f2fd8c030c600d6c9bfbf8125ed

SHA1
d47621e02cdb0508686650f9571a2e224f689970

SHA256
e7cc36d77b5d019e6c51f346b08ab58920a17a32d8221980ed0f3048522634a8

SHA512
d7ead1ff510d43dc6df6ff8ed53c216d3bbf6807f6947b260ce7844ed8f90f9dfe6d8d5701267746b743597eaf8bd56facaa1c3028bbda32a3116e149ba98a43

Download Submit
memory/5048-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5048-1788-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads