6aa8b852ed12213a9c7107591f3a108e0553681ea3c5b3646c593b5776206da9

General

Target

56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
Size

70KB
MD5

56a313e564f26b28827246b42f36b190
SHA1

77873aabfad8b481aeb8a90605a23605b32efff2
SHA256

6aa8b852ed12213a9c7107591f3a108e0553681ea3c5b3646c593b5776206da9
SHA512

2baa74a5a156203bec3cd0fae380d2d4f5f0ab0c0c0421cb5b399002ded7612a7e0f632fb9ca525653af6b1ec0e0e1d6948e2131505c401ad40b20f610f786a9
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJX66Fl5CN:W7ZDpApYbWjIlE77ufL2e+e16al5CN

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4830) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\56a313e564f26b28827246b42f36b190_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
Filesize
70KB

MD5
0b5ff5a3b1630871e4a04454d0f5081a

SHA1
71ca5f914d75345cf3743b682aecd672b9dbb968

SHA256
63d37800a4f5acc9a10a7969152ef7f235cd2af7184d056b5f7bc7c29065c627

SHA512
b46f62d4c3d4e0f90a6ac65db669f9b87720960102b68d4c58f7800217e812ef54261a56d51d721117d728c2a7ba3123201e9f86a84eadcaaa26b93f69c006d8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
169KB

MD5
1080078fa84693691b9941abd2b9fe8c

SHA1
50f29df9a134e75df833783c736d57715a6e3960

SHA256
3490162ea471d1082fc8357fe26c5da1063bfbc1f0886fb77faaba0b518d28ef

SHA512
5e423c82d24897b9804df1c53a3fdc812bf4e6502b9af7e9622b33c41a609d75d472ae3766bfbe9f70505c08066b81fd2ca198b7f73e3ea963290d1d00ef4410

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads