28f7e65aaa0266e309e747b80e266593fb85951eeb02eb9b3a0b6ec362821231

General

Target

579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
Size

129KB
MD5

579a737ea1ac88b51e3f80ed45e79ba0
SHA1

daf867c0e4325ba6e324b3789df44dbd99075818
SHA256

28f7e65aaa0266e309e747b80e266593fb85951eeb02eb9b3a0b6ec362821231
SHA512

7ff0778286ed35aa9c0c47ba90ea444f18a85a6ee9fb6d2389a38c6f94b3a5fad1e336e999195a736bf94699457e7ce062a5189046d83f93ed0da77b87d140a1
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c50KPKV:/7ZQpApUsKiX26Kaw

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Windows Mail\msoe.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\oeimport.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
Filesize
129KB

MD5
0b95e4838a0a7b6a922ff86b7c749083

SHA1
cf8fc43c98456b434a68aac16831e033a90de238

SHA256
e3939fae4119a04f283921e8edad2a7d5261cbdfc56f19859ce3c8b719430d3f

SHA512
53d6cf997aab86f282c7d26e63666329c38d384a140711aaa539ded0fe795b512970b25ef85eba41ebec8c46ff601b79a24c8f73ff288b952f61de565d953bfe

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
138KB

MD5
dbe9f8368f2675961d094972d61e5e3f

SHA1
1d9eea8a6c69f2d987db739971c5d40822edbd79

SHA256
29433831a59e026b51d623c51c6d8d6a440833c4fc4497d509843159163a30f2

SHA512
198871c858c1cb552d2d502899b56cf6afc2ad92c4d54321e9012113b33c20afc141f8204d55e44259a9de71cc4d367258b65d4c265b5e828f5eeca345ed2e7e

Download Submit
memory/2000-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2000-386-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads