3ff7015e1e139f9374d4c85a5369f14e62e6d16e4f8a29ebebb17c5c0a39813f

General

Target

58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
Size

1.7MB
MD5

58d05bad21650e86b54addfa877671e0
SHA1

d75b54bafc3681cd7f302aa265561a34c550df41
SHA256

3ff7015e1e139f9374d4c85a5369f14e62e6d16e4f8a29ebebb17c5c0a39813f
SHA512

cf3c8f69c95db750e1f75135a0356d01ddf7d2cf28fe00856add1c55c11da8779eac0311c0d5443f120d29e7616c902f8e703a144343200578a9e20ebaecc1f8
SSDEEP

49152:iFNcMPdQCDYtRsiX3IaPyupWaDy3lHa/Q3Hx4FDATud5zaYu:iF77Ye9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\58d05bad21650e86b54addfa877671e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
1.7MB

MD5
72b4e66d426deea1e3c2dd2a29d8f098

SHA1
8287d6fca620afb209f08172b9672fac80f571db

SHA256
4ce6ab709670bdc677843192b52e344b253b058120b409c83fe329b62daee795

SHA512
66a8e662382aeff90ff1942ae6bf8273c78bc6c19942106f41602fccf722b18bc3f45a6f012d6493d73b0e77bcfe1acc3c0e2697520304fc73e8f4634aa2fee1

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
1.7MB

MD5
230232e2c4d491f2a92c75417255b316

SHA1
6d572762d2cb727266d595766d626c44e5cd0cf2

SHA256
82f18688664097ec0e3366fb5dcc97e1bede00410aafcc2c9a0a5171e1299f41

SHA512
e88590bc30b33ae1df6fa32b74a36c3774bb6848bd648d148f5883841f4184da9fac8f4ccd9cf4cbfc7b510c3dc75eb716d6e8a1bd455988f5c8a4b80892d3af

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads