ee4362fbe8ccfd393a8ca2cd724871621885b66ebe0f756bc255ec663d497aac

General

Target

5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
Size

79KB
MD5

5549b43f874b34e7f739fdbd1e4f51a0
SHA1

903676f462f72624d734f3bccba0a961cebd8a02
SHA256

ee4362fbe8ccfd393a8ca2cd724871621885b66ebe0f756bc255ec663d497aac
SHA512

fdd84e4d6b78f3eb61977f478f04b66cd9a21452ca45f7ac95bd2b561d92523c7248d5458e9dde88932859eb9d256a6fbace7a40962243f00a063b28c2e5c298
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHA:W7ZDpApYbWjIlE77ufL2e+efZwZavU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\id.pak.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5549b43f874b34e7f739fdbd1e4f51a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
80KB

MD5
413e63fa8aa66d299767664cf49b6e0d

SHA1
d9821ac2ba42b0da7bbccf8a012a06fec07e2a03

SHA256
208444c330d823815fff4cd75b1703918ecd0507db4e9723a5d50a657b0bdcad

SHA512
4816a6b043e61b24ab394956a41504171fd40d382211f003e7185416b0549c80da0f0fbaaa5cc182e690bdfe1168bf7de880f64444560d76f155ec5f55b29214

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
179KB

MD5
1267f0785f80724ad52e994364281dd9

SHA1
22817d8060436406cb2e77068ec14f93d16e3b25

SHA256
35b19ba23a50d289c294dfba19aba8c15e856ea5952ee3261e1d43adb6310be0

SHA512
49033be67a290844906adb26ac2ce8b9a0a49ec2b0128c36c78bc95e9667539608383ae7d0c3b4052b8b9ada85c0825cb6576180c4171106e5c3ffb29bcc81dc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads