5bc4ea0bf979af9b8b00bc29e70a35910712e17defd610a399aaf9c1ccde267e

General

Target

5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
Size

81KB
MD5

5d947504f91b6cbfc81b8e1f9ee45ca0
SHA1

1486820c364fc3cdbb9e0cf6a65ff338b2f563df
SHA256

5bc4ea0bf979af9b8b00bc29e70a35910712e17defd610a399aaf9c1ccde267e
SHA512

266469e2ebfad161cb084d59d5a3d7df4013347425bec3a6d3e5296c9a991e5298586e37e56854caa940908acc4c8ea28e94ebb68936cc88034a89981015c8b6
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKZJHJ/vu:69WpQE0zV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4946) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5d947504f91b6cbfc81b8e1f9ee45ca0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
81KB

MD5
ee72a1bc151fd0213087885baaea75c7

SHA1
84c476c321d5215781c9a74e7286b3770d3c06cb

SHA256
71420ce7390b376b2cce20d3871e5666392e7506cdee3b7a62a1c849a12d583a

SHA512
4cda7e147c94aaaa1a0844eb0c411be9b1be15419dbfe83b4ce154d771c62f007fc9a2ffdcdb7b35775ede412930badb6009ec3541b071afe0aa3091b34b56c4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
180KB

MD5
5da11811c89372daaf6debdc92779057

SHA1
f73b567684db73674cc99f8292b6dc4578d3404a

SHA256
05138c4d3506ddf99424eca6936fba2de78f21e3182f2c6806c4c45cb2df335f

SHA512
f74f1e444d3e107094d1c8c48c773b224a48474860a25ebdac412555cef32cffcb8dc07d4b68b8d99e335bd372fad3cea04315715aa2aec1c7adc44d7b028333

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads