67d95e9665a109b91f868637119f88e2f8af82c79c8b6d15f21350f560dd5edb

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
Size 66KB
Sample240512-jsj2wafd9v
SHA256 67d95e9665a109b91f868637119f88e2f8af82c79c8b6d15f21350f560dd5edb
MD5 80189d083862f6d893ed2ed5991c79f0
SHA1 9b4cccd9257b65b4ba37181dc50e22de41aad91c
SHA512 d8fe00e8a7b509bccbcd44d0559a7205800b1316029ec1d267abf057cc8e4336524d3046f8f1361df883b87fad53717525874148454ec5b0f46c05b50cff8af0
SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRel:W7ZDpApYbWj2WTWJe+e/qs
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1375) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationFramework.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationFramework.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.Forms.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationCore.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.OpenSsl.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.RegularExpressions.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ValueTuple.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Primitives.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.Primitives.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.Win32.SystemEvents.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Sockets.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TextWriterTraceListener.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Input.Manipulations.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsFormsIntegration.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Design.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Input.Manipulations.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Xaml.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationProvider.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Serialization.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationCore.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationProvider.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Primitives.resources.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-2-0.dll.tmp	80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\80189d083862f6d893ed2ed5991c79f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 67KB
SHA256 06f4f504241d43c0cfcc822ad499ae42e5f4bafb6178ba1ddc80965bc57c5858
MD5 0541ba023b93ac545030b9f95f84291b
SHA1 32567362a7c6a0d2ecf2952884631c763e3e9d44
SHA512 e48e231e97d62328d0a4fb7b5a694d19e54af97587324163dde7ca350149694cd8b15eba18747c2149467e1d8863fa627a080a30c5ea389baf56e68db5d32d51
SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReN:W7ZDpApYbWj2WTWJe+e/qA
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 66KB
SHA256 b73d44f29578e0d83e20fa0e2c114f972fcd59618c147c578cc9d45ebcafef2d
MD5 2e8140309c2733331f260470daf6d50d
SHA1 fd06079bca78e510964bb6af1950b0e7886f8bc0
SHA512 daaac8ad1da9e3de0261481a518858d609c6211c000da8cbbd46b9d44743480bce25149d800a694bd7ee1638fc4e095fce6e2d47f3236a9920a03750483eaab6
SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRe3:W7ZDpApYbWj2WTWJe+e/qW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads