50416f3a0092ddffa8ae5a2de68e5138fad3a8f25bdb753a9acb61646e6a47e9

Analysis

max time kernel
150s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
Size

77KB
MD5

544f3b2a1b42d3a7028c1e976dfbcd90
SHA1

36f581730f87901b0e7d148f5d7371d4494f87f5
SHA256

50416f3a0092ddffa8ae5a2de68e5138fad3a8f25bdb753a9acb61646e6a47e9
SHA512

9d3755670b702f380c6c38f32548a1324051b3ef2403683dc5d2a2d10801527d3f3b24744db8a5a46cbd72759352c7dea7b3e1c5b7ac161957f93c6609256b48
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65TGAzEWzVNOx0ypIzIu73mYdE9aC3s9XL7EWzVNOX:69WpQEJAzEWzVNOx0ypIzIu73mYdE9dP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4874) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\544f3b2a1b42d3a7028c1e976dfbcd90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
77KB

MD5
b147653eac9568c6b4cf6fcd4542457c

SHA1
262706e286e3adcd5e5f2dfd90ff7268a07db1cd

SHA256
153ecc1c1d6ce76a114eff49609aa7556ee08f5e1370fcc423651282aaaceb54

SHA512
5f09cf135f6687a027bde9e184d946bb82e7b1f93f2e08b6bbdaf03bfbb94693994f553c754c928f57b70984fa5fce96db804a366c6b985c86a78a48465b0a95

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
a18737a0907743b9070b71e657ec9250

SHA1
53e2e7c0148c2fdb87df06358cc0868d9b3b08d3

SHA256
308cb5f24d90941a2946d99b2486f93a4d8a80a3c48f030b0d188278899f43ba

SHA512
d90d7ea7d465ff5a7c5aeb7fc18e7fcc255151761d45872de44db602da23b3206383998a8bfe9c1427be2668a8631987adfe7c1f3b6e98b9a36c81ae9b3175e9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads