f8817b717e5abc20bb5df4d694ec10c6f7fecdb434bce2f3e233127658170b5c

General

Target

15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
Size

117KB
MD5

15b72be5a9b7ea4895515660f5c61970
SHA1

84acb849ac8d3c3e37082f38aadfdde2bd5f121b
SHA256

f8817b717e5abc20bb5df4d694ec10c6f7fecdb434bce2f3e233127658170b5c
SHA512

68dc8e3d0bebe30aea84c17692d05c00e84658b506726fa1bddf43deddc12d44bb1d77324491edefe7c0cc92565613f6f515b74c850f72f69acdc1ebf9ab3bed
SSDEEP

3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEIixihyKoIWbsHfySkT5GeCyi348oWGRPOzkA:tFPxPke+eI6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15b72be5a9b7ea4895515660f5c61970_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
117KB

MD5
0481c811bfc74d1302f43e954a87fe9a

SHA1
a5a648d27d6e9bc438a807bd89c98bb3af91368d

SHA256
35ce92364a11f7dd8a86731a5e7f4bc94291b78375fb13b50f31e213354cdebe

SHA512
fbb3466151216127879474757210f58d4e92d0647e01cddcbe29c27c3c59d22f42510d8856e170e51e2e12e36407ff29ec122acb5272368118bd383fa1d04884

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
216KB

MD5
1b3f1d335e82f7b394a2d2af33ce6276

SHA1
04c216f58b3c9537494e6bc79ab43bf906942d49

SHA256
5f48e45aca7fa38b793ad2a126ea402764568a49542fc59e1e56b02a832faef1

SHA512
948718dc9c5d5f84b81cd11928cdbf2f987245e07cb7d5ce51f40c1dcfe9a033baa045178d32a2a4bf7426ec7955affbafa67852443facb097d690d90d6832f7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads