0c5b3144a385d4f4fd0eae4d7f8d59849d80c6ae3de082f631ce340fbcd9b12a

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
Size

82KB
MD5

6eaface3d117b58e32e0620d3d459750
SHA1

261ea40dce7024a66346026186e4dfa131aee4f0
SHA256

0c5b3144a385d4f4fd0eae4d7f8d59849d80c6ae3de082f631ce340fbcd9b12a
SHA512

8457e51da6c5a565f126bcebce1ccc153a2219109ff03b5374ca229b334bd99907fe8d2af5522140df1ca292542dddc66232d6b1fd7cd9ea247866f8b30285e5
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76Rb7gz:6e7WpP9oVLQthbYY9oVLQthbUvUgz

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6eaface3d117b58e32e0620d3d459750_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
83KB

MD5
c5982dfe6d16644a9148dafe3e10d0c2

SHA1
62b3467cdaae4ebbb382ec9f516294f448893d8d

SHA256
30d488a4e176430cd496c8fae815b239a8c199388a1fe02ce75a707a20a2649e

SHA512
f7d63609e8b804ba91838c43088726a0b4c9c5894bd5402ccd7f1f190471fbef08f527bd75a2b5db1f823c071b346fed295eb40bb107918a559bd219f9adb79e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
181KB

MD5
226c396aeb45aa748e18c96293a60c45

SHA1
84c84186efc99bcb13989eae3dc206b0385d102f

SHA256
f0478712eb525b5eac7b46609412866f82a89e1c3d49b4bab20165b42ef0716e

SHA512
7f31a13b36d4b3cbaf3f063a826ccb0337e7d52643777f76a1d3d36b3f44b57d879158ecd6ca76a833d0cccaefb805085c5a3c9a0ea4d6ed07cabe6996c00cf3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads