dc691adc1145cde00ddb8adf7ed5d31835ff31d1f342bbff7750be9247974680

General

Target

43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
Size

81KB
MD5

43e212260e7554f0280fbae1b44ec6c0
SHA1

2195a1d6c2fd193cc0e4a25872cbd2df794773c5
SHA256

dc691adc1145cde00ddb8adf7ed5d31835ff31d1f342bbff7750be9247974680
SHA512

767492bc2c5733e786b06b6af2d8bcf7f972a610e82cbf114859ee90dee2f6bf9436fe09b39aa6f3eeb87693219f2830477ff81e777b3971011002fe4a50bf51
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/6lDN:6e7WpMaxeb0CYJ97lEYNR73e+eKZaDN

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1377) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\ReachFramework.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.PerformanceCounter.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsBase.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationFramework.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationTypes.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationTypes.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.Json.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ReachFramework.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.Linq.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Json.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationTypes.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationProvider.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Registry.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.CSharp.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationProvider.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClient.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Parallel.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.DataContractSerialization.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Annotations.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationUI.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\PresentationFramework.resources.dll.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\43e212260e7554f0280fbae1b44ec6c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
81KB

MD5
d7b5649b46e819de498da7693c2cc755

SHA1
9f18b9deacc31ba635a39488e27ef4cb892592e6

SHA256
829fda3ce46e899525e580b9a3303f5dd9497b25c6d4090efacfc6656de585be

SHA512
058198414938462910876fbd1c7e774ea23c9ae9e712a2ac39587633d70f093a551a9d3953c0a7094e675448587ea14658c026f98065d533a5298320cb894f61

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
81KB

MD5
9a53cd5ee894f2e0c25fd252d0f2e1ce

SHA1
a05909d3221c7f5fadc5c3c6b198ec001879e17f

SHA256
f1d746c087fe623f09a6ef30775fda80406024990f86454a19c15d3a96646872

SHA512
847f1635aba4ef2c957af53d82d5f2ef0786545273c13042e6961408309fdb739727dd6d70a2163fbf0dd056ec9d11b1ca9649f5ddb29840322aac74a3733478

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads