e468db9f9fe13b08740b4074ec51cccf3bf0e689b52506f5e7d0920375d3044b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
Size

80KB
MD5

528bdf942902cc0381e04285a80f7ee0
SHA1

118230015600e4d2a7e24670b8f7a9b1a7bdbe3b
SHA256

e468db9f9fe13b08740b4074ec51cccf3bf0e689b52506f5e7d0920375d3044b
SHA512

ae55c73eb61bc4c06583cadfa77b4091d0ea2b56e48b65ce6eda457ad38d0b782770ec56ae2e9661adb47496226501473196e174199aa8c189bdb551dbc9c55b
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReG:W7ZDpApYbWj2WTWJe+e/qXg9j+9jV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\eventlog_provider.dll.tmp	528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\528bdf942902cc0381e04285a80f7ee0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
80KB

MD5
76f71687202bb73136f65bb25600e6bd

SHA1
a27490943c006ce7623f52c7ef6108e149e24a81

SHA256
2cac06ef570d329f4b338845291c800e1a74f89e290340a1cf0ee4ad70f48a97

SHA512
ae9cd2f799cb5505bce9250c23577bfb9c6553f0949fcb2aedf69c51cd4c8a2d5a52a6b0f10ab8c9de4cbb82a0d36f6359420508b5529473c60c49845e208f1e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
8431b851ee0236781caf93cad3cda730

SHA1
1636cebe25b21a0c50183164f98714afb2c8f4e2

SHA256
2fa642d157f4372ff359536d550f28886cfd9fd76bce43c0efca271d6f33f5fc

SHA512
1da1c1f00a9e3865c955d07f676ef1ec63f8a1f9bd4bfb1793649decbe4c90ca2aaa11855e509f8ca418cb8e8a128b44413608d7933e6a99029e1b1f62d084af

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads