0045949150a4f7514a47646a734bd11f2b55110fcfa460eab9baef59ea283540

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
Size

143KB
MD5

220ce25c714cb4289254e39dd00718b0
SHA1

a459f837cc8be4bff006b3387ca456210d03079c
SHA256

0045949150a4f7514a47646a734bd11f2b55110fcfa460eab9baef59ea283540
SHA512

3e8117769133fa70895c58c6c5529d5c992ea5ac7f473140681d1c849bfce6ba1c90b77ca52e8736c0392f5728ffadfa4ab2a04a68081b8fd003efc79f5c2b57
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXBvjfMfvjfMMfQsblBOo:/7ZQpApUsKiXBvzwvzXJvlwJvl0ey

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\220ce25c714cb4289254e39dd00718b0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
143KB

MD5
f1a1d74ccecfd87595db32f2f7e9de5f

SHA1
f47cd69f56abc9d8faf0e546d9922910263198af

SHA256
adee6df2c43290d3842c35f518824f62c21823454ee314757b8aabdf880049a0

SHA512
a78b8f40709a272590a6ed41f7f184aa58a400e3336f05d0abe73a9a0828b9e4726cfca8519ee6da825fb3cac4fca12df25a11396caf10dc09f05c100b2ea101

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
242KB

MD5
6abcad4627e0d325a2b41058218bac07

SHA1
6c83bc9238e0b39bdc3b4aecb54a6ee4e8f1b970

SHA256
11a5a5155db105c679cc1d5ea9a0cab1d01f7d9d08994de92cace2598fbf20a0

SHA512
20956680f8eddccbe1e29fe34f90d769e54b353c8e3a0dd0e9485dfeaf079e376684fc9aceea9162180151e650b56b044e4a8e09dbfd8dcc73c36545ae4683ac

Download Submit
memory/4664-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4664-1588-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads