28f7e65aaa0266e309e747b80e266593fb85951eeb02eb9b3a0b6ec362821231

General

Target

579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
Size

129KB
MD5

579a737ea1ac88b51e3f80ed45e79ba0
SHA1

daf867c0e4325ba6e324b3789df44dbd99075818
SHA256

28f7e65aaa0266e309e747b80e266593fb85951eeb02eb9b3a0b6ec362821231
SHA512

7ff0778286ed35aa9c0c47ba90ea444f18a85a6ee9fb6d2389a38c6f94b3a5fad1e336e999195a736bf94699457e7ce062a5189046d83f93ed0da77b87d140a1
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c50KPKV:/7ZQpApUsKiX26Kaw

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4739) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\579a737ea1ac88b51e3f80ed45e79ba0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
129KB

MD5
bba77083f82c1b50e7ceee5d821f8253

SHA1
c7ce946a564bafc15df36beb7c28a553215cc6b9

SHA256
cb9f8a268fb38312abc99472d719ba49f82e959fc177d1a89c1c97608909b051

SHA512
d5dff9638a953fc21991587b221ca9257816bf2e82c932b610504ea4730ff8568e1504a950e416bcce1259f6c0307ff2857949f186bdc6f25bcc037e494f337c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
228KB

MD5
5c25880400b6a9876ec98179c2aa7201

SHA1
0452558e1fa16a2750b407eb0b8a34561fb859a4

SHA256
a68f82a5c220fe7653b3d67b9565129053cd48b1f48b1c5156b3d5da22d05008

SHA512
60e324b22ce86717db3f659bcc78e6c1a487a78bddb9c9c07590b0fda74c88b8f381b36587851fd4fdc96761cefd692c603503d3dddee30694ddd45298b941f3

Download Submit
memory/4876-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-1750-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads