83f235d587074eac16086a5a17875d3a1a8d2db9a988dbd25774d613d1ef351f

Analysis

max time kernel
149s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
Size

65KB
MD5

d47c48733b703d0825f00f540af80570
SHA1

732427ee9fdb5bd954591870d0a7cd904480edf3
SHA256

83f235d587074eac16086a5a17875d3a1a8d2db9a988dbd25774d613d1ef351f
SHA512

f8bfd8d37a50f940e201a0c1532c8afde80ab0580a9c88b2157149779974a8360202b56a85bd9dff317295f0a9c2ddf3d862ba9b750f06b57698f6c5bde8c116
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVv/:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDc5

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\UCRTBASE.DLL.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-PT.pak.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLCALL32.DLL.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CENTURY.TTF.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d47c48733b703d0825f00f540af80570_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
66KB

MD5
46d1a51ba97bdd76d9fbd80e1fb0c297

SHA1
7ef33b1687a3d981ed053d7114ab2b36c2746f82

SHA256
2ecc02751ccdfef9949ce6ad03a11b6b3f887c122a3c32546c895b6a96377438

SHA512
3371177091152f9870fe1406bff7a3c5efb6f99238000f2914ef710d00e9e5ce036ed7bf57fc47c0e899c94a18b07142d41d89744bd62e7ef96d499aee407ece

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
164KB

MD5
55978a20dd874819720d04d84b03f3eb

SHA1
9142ecfb430387f98475caf0a4c64efe3ea533b9

SHA256
3c323547ef4c82c30b9e88e0cf224a5b93392af981a6d569167e353e8d0e7148

SHA512
ea6d03e87512fc9e48b98eced4d0f8b7c0e76d4848ac55f510a8a2873baa46e0b61aead903156f133f7facd6013d64906b7587a4ad9992f9bf2534adc1b1aa42

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads