c2b84f85300d39ff412d7aed288e444c4896828bcaf4df726b14f2f62e343715

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
Size

115KB
MD5

a89f503d405cafabe72b0e53c4e72440
SHA1

7a6dae45e71edf5d1cc8944abbbd7e79119ecc4a
SHA256

c2b84f85300d39ff412d7aed288e444c4896828bcaf4df726b14f2f62e343715
SHA512

2176752e2ed14e60acb2538d9076e999006ca1c6151d6c337213c796fc1e238fa5610b480a651ba48916ec6c84bfb3422bd632f1b47ef05525a312b82b3890c5
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5z:/7ZQpApUsKiX26V

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1369) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.ThreadPool.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationUI.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClientSideProviders.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationCore.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationFramework.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationTypes.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.Forms.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\CheckpointResume.zip.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Security.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationFramework.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClient.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Controls.Ribbon.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebClient.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Xaml.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Primitives.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Permissions.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationTypes.resources.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll.tmp	a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a89f503d405cafabe72b0e53c4e72440_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
115KB

MD5
2e6e682eb09a7ecb3438e3b29bf750d4

SHA1
8e9b94ef46168f18e98a77d1d314dc6e81b61b77

SHA256
4b02965c18b4bc0aab3862dc33c9aff584e0300cf4246c413d29be96f0a38724

SHA512
75a56405efd64d60cea0ce6b66baf847de0797e06a50862cdd53a12394518aa77fde7eb28aabad85948767697363bea77e5b3afff8d06e7d6ca5fe739706e50e

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
115KB

MD5
b951f82e9b63507421d76cd4f6c263c4

SHA1
b7ca5749ef1ed76ab045ff47ce5165a6f2d47ef7

SHA256
ff9daf91857a501d354ebc38b9a0104f85a2365d7227ad72a8f6ac6cf2971311

SHA512
d1cf9ca7cd95920068f9c8f61e8413226ffa2cffb064eaece3c837c2210ff75c7d08e3061015075898c9507a6fc8401f0a99b711eb08da0c254287c371d1923b

Download Submit
memory/4140-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4140-396-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads