bf9000651add9350bbf729d1c68f621b92362953024b34cf56a08317319d80a0

Analysis

max time kernel
153s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
Size

72KB
MD5

2a5e0fa18bf25e875ccc52a029648cf0
SHA1

5f13a28293ba27f75b6401cef1a96d2192df3880
SHA256

bf9000651add9350bbf729d1c68f621b92362953024b34cf56a08317319d80a0
SHA512

8acd72933537678b96bfb917f40988693e12657222f712978bc07ff57dfcb87f90ad79728ba6c50f690356af89369d26a6a2479d1e4e57026fdb5f30e2a1d847
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/6:6e7WpMaxeb0CYJ97lEYNR73e+eKZ6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (532) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.ThreadPool.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceModel.Web.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-heap-l1-1-0.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.Linq.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Configuration.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.AccessControl.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-2-0.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.DiagnosticSource.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Uri.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.DataSetExtensions.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrgc.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Encoding.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\hostpolicy.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
73KB

MD5
22159c95e4157a5360b8c794b935bea2

SHA1
1ae8ce1fe63b0f34a00580ec6329c15ea22f6dec

SHA256
b4895f3ef929f1a70579a511fe3973b3deec2b49c49fd47d9d6c702cc96aed19

SHA512
d9a4529f16a4a889c39e216b1840feed00c46dcc15c0c215f18e8e02805470ae7a3f3e942674ebc003caf0cee79b658ee6fe39c1c52e6ae5d1176b5a80201dab

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
72KB

MD5
9c40eafafdcd5820c28438681d12358f

SHA1
1f401efcc7d6aa24524ca6c83e56fce0ed84a9ca

SHA256
581bcf2ea89c6ea2966fb3c57dc24050d7e8791808e0c1f99481a6ea16abf8e3

SHA512
66360b6c688131970bcdc6cc4a01666fd1bfe9bfbc16030b0ac46949f1e7874511680262cbe5451a7fefc3518a492e98b1589763f340141066917e96e92da1f1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads