267347978ca73693cae32a9b34cc16247e98aaa5d1a85b844cea28015d5d8536

General

Target

403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
Size

75KB
MD5

403ccae208266342f3205ca8c9920490
SHA1

e11da599ddff0a76f89876d841ba0f7b4617a933
SHA256

267347978ca73693cae32a9b34cc16247e98aaa5d1a85b844cea28015d5d8536
SHA512

a9a1a5c5c21815eaa165084806d08752fd69ea953f2dfd3452f4c37b0d54857b498d55ab8570571ead2f7996c4164ae9480107aa44097785429b211f3661b011
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhl:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsE

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (821) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Primitives.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Queryable.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-2-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-stdio-l1-1-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Parallel.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Sockets.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.CSharp.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.TypeConverter.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\ConvertDebug.ico.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\CheckpointFormat.xls.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Formatters.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlDocument.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceProcess.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\WindowsBase.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore_amd64_amd64_8.0.23.53103.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClientSideProviders.resources.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Immutable.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Brotli.dll.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\403ccae208266342f3205ca8c9920490_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
76KB

MD5
9adfab3e73e006fca6ef3566739b705a

SHA1
757dc09af44656786ddcaf4730677daf5881f48a

SHA256
486dde1af436af09213e740f195d7638065d8f01de45b98cea7c1c6157ceaae6

SHA512
08b4b88c848ab60f1d70e191fe0b9717ef234ffd89a9690e1c2502abfb94e072548501468f8682c6603c26cd9e1f39bf04308357b36075e5e76d5e15eed4c64e

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
75KB

MD5
5f8383b4c3e8a9fef22f5674943258b8

SHA1
c16e4369bb1bcf94ea7fd8d59580f49e5e9ca335

SHA256
a116a03f45aeaa61806029e6ed84497594c35fd66a5e263f899d71dbe0741a4f

SHA512
061d316e8492f7ec3b3c63f40af813ac58263c35555a911c34c161a92570cf50793142dabe6e34f3d2662854461747a0c36834c3a8bf553e78638616ce6d09bc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads