2b1cd29f806cd28b97a2f2aa3221b940aa02f6babd59b1d9fa4b89a6e721c4f3

General

Target

35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
Size

71KB
MD5

35c90f76028efe12d0c46adc48251b70
SHA1

4cd1f81e52819c5be9dd960f51cf352a6cc8989d
SHA256

2b1cd29f806cd28b97a2f2aa3221b940aa02f6babd59b1d9fa4b89a6e721c4f3
SHA512

69ed66b1dc6a29b15dec02610b0407ccd15b7aa259f679b2c3834e035ec8f4de7b0af2ede2e01053fdcf025632c70a18d40483e02697a46c03a7a2ea2eeb20af
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVv/UPJ0PJ0+:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (992) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Overlapped.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Royale.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Json.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.Primitives.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.Extensions.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Csp.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XDocument.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Thread.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Input.Manipulations.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TraceSource.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.ServicePoint.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l2-1-0.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationFramework.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsFormsIntegration.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Cng.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35c90f76028efe12d0c46adc48251b70_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
71KB

MD5
cf72c600ce881cbbbdebdd841a4c6b88

SHA1
bbf90d634a87911066fec5022d6873300fb92072

SHA256
1f9e8466afb0ea6c1b451f9555b27e6f146c750c18b10c28d4b26e2e78056584

SHA512
ce9371aa90767729debe58cb8c903d982db415328026bdfb96815e67c2e117f8b57bc48cfe61dc5023c0191e86df3f421efd477e5eaeb514aca98d5ba2e76b1f

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
71KB

MD5
e5af949b78b42c0211215388675d2345

SHA1
227ff17ac451e6202da5871360c5cd4d32f6fd36

SHA256
6b9a3ff4dba6de6049c50eb7a79c5343f831380c39a16ca1c9333b44e2a9ffb1

SHA512
2a841685a8baae4579db9e808322b6009885f43aa2e36a9aa51690f7d9fca212b0d8e6f8449c9ebb14681c7e24fd47a4d9c933805080ba239ab6b31d1142749f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads