2523db612f41231a4be65e1efe499ffb4ede13c3de14d051bf77e239d7224602

General

Target

5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
Size

76KB
MD5

5c31e6546092b1a54de559ea49f873a0
SHA1

456dfba9bce5f2b3357ab2c5ffb670f070c2031f
SHA256

2523db612f41231a4be65e1efe499ffb4ede13c3de14d051bf77e239d7224602
SHA512

57d223628a870f1f55c614c4c336034b3c5a87b96888c2abcee291c945309a9ac461cc20bd2df6726c07a1e94ca4caa0cdea48a26d0589199c84f5d49305bf39
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/F:6e7WpMaxeb0CYJ97lEYNR73e+eKZF

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1372) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Primitives.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.AccessControl.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationProvider.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationTypes.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.X509Certificates.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationFramework.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\ReachFramework.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\ReachFramework.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l2-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.Primitives.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClient.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TraceSource.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClient.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Xml.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationCore.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Primitives.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Input.Manipulations.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.MemoryMappedFiles.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.Client.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationTypes.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationProvider.resources.dll.tmp	5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c31e6546092b1a54de559ea49f873a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
77KB

MD5
c6a18c628b89193c3e955464837c11c4

SHA1
19327ad7f8536a9b63b191e13435b1a01bd0a2a4

SHA256
6eb0f8f9b7790d37c33baa3bcdcc666340a290945da354b07c11978d3f2f3332

SHA512
74c2686deb4f7a79e5f5c7bf6fca2c8bba7c4a74902bafd9753e0bad909e0ce3df296d6ecc0494ca2429bea70113ad4491e2f7f6f933353ac067d93f4144aaef

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
76KB

MD5
7ca4f93015756c3116299ab62afced33

SHA1
c9e1e96a6de5b473de536d09f674b54fd893f0e6

SHA256
004d5cebe3c32f561ed6cd7a1a1152251146d63624f729f6901fbaf548168025

SHA512
676162949604f98c72b7d0df066d8eb4ddaf89ccc526015ac4a36179102a656a45f6c395cae6f04fcd2307999cb057cd943888b5e72082a4cb2a9564f3ed5d29

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads