795e2b57ecf46feb5809caef72e5fe66a654836f89c4d6110d9219bd0bd7c489

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
Size

80KB
MD5

043a453ec70f2c8c0630d98aeb15aee0
SHA1

04bbfdfe879afa6aa09995cece4abbd7c87470dd
SHA256

795e2b57ecf46feb5809caef72e5fe66a654836f89c4d6110d9219bd0bd7c489
SHA512

1af58d6b6ac649d27437d427b001dd0f05a9d4f6a8d5e306263c93869fd84602e437d86b05ae8c4bf995d42beb5712e22f1a0ed4f34962667150dbda3f0a4775
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/YUuUR:6e7WpMaxeb0CYJ97lEYNR73e+eKZ3

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1378) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.JavaScript.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClient.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\ReachFramework.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\DirectWriteForwarder.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Xaml.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-debug-l1-1-0.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.Json.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsBase.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.DiaSymReader.Native.amd64.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsBase.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Aero.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.CodeDom.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationProvider.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsBase.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationTypes.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Brotli.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Numerics.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\dbgshim.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.25 (x64).swidtag.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.DataSetExtensions.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClient.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Dynamic.Runtime.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Channels.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClient.resources.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.IsolatedStorage.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\043a453ec70f2c8c0630d98aeb15aee0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
80KB

MD5
d2f91bedf91e61a9eec0f192f05fb473

SHA1
d5fbaadcb814022a901f7374d43e701c5e5b446a

SHA256
9572c27b95002e0026ad5222efec5a981bab77127503ce649e48999ca6a20adc

SHA512
a5f4955d6661a16f083d22f5bd6d968a5e9a904dd921b769e1839df324d0ae60a4834356411666735ccfe41d46b91d2c6309bfb29656822ec4e11ddabfc7c92a

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
80KB

MD5
17e8695acc880525f1548ee572b6c15e

SHA1
58a64e69bd6387571a7e1e757e0ee7d5f0c91517

SHA256
a74f77c352737f14606e01a32d82fdabcab5d9ba36490678ef8176d88a58c1d2

SHA512
694e9077aa74606238a0c5c7aca725fc006848ed2142e433e02acc6d362a586e1f099dd4e10a2e285fdc0a01bcd4cdc50566f0379c59e5af98133b736f23a78c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads