471655d4c1b7207fb1219ec3cb1c187178aa6626d8ae15a4781dbee03b337f78

General

Target

07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
Size

138KB
MD5

07b92c1fabc9edbdceb550dd4fb30e90
SHA1

fe2918bbe2f7f08432dd45d60bfce574148136c3
SHA256

471655d4c1b7207fb1219ec3cb1c187178aa6626d8ae15a4781dbee03b337f78
SHA512

aabfa91fb0f55e2e4bd75c9e47af151f2dc106e75561dc4714f7b69801de6b0cc9c47ae579407f6aabdb7f4bf62d67253de404937bb893dc8db0cd95de5cf5f2
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXBvjfMfvjfMMfQsblBOs:/7ZQpApUsKiXBvzwvzXJvlwJvlC

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4819) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07b92c1fabc9edbdceb550dd4fb30e90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
138KB

MD5
4597eb894af0fa1efae8722ad3f9e7b3

SHA1
a1db8e26f191e9e8f33aecd24133acbb0bfc1116

SHA256
4d5e1582406ccc19820f8858a38e6013677f5ced14e9ffa6155b67663fa4a464

SHA512
3136b4bbd66870fe034b55a4be68f6d901f95817d9523d949f8257a5013c3d7a62458db040c30a172a2cbd4cb4a1fbe233e1c3d2dd8a5bc2d9812c9dd398c627

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
237KB

MD5
cdd9addf6de4db7736b1a2c15510a640

SHA1
a0bef587170ec7a1a69c3a2f885ad480d280210c

SHA256
7ce9c8dbef26572d077e46fef53fbf42b208e9f5d11f03dcbc4f1baac7082d32

SHA512
99ec837d7837609b70aaca3c94744dc613dede5ee92a711ebe31d8b39ba09f6fd78f79409394e17d028d46acf89fb4ebdd759d74137d1a30a5dfff99baf334ad

Download Submit
memory/1612-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1612-1784-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads