3c88b52eccccfbb5ada039afa6f74a2350053ceef5db9852e99b38c03f3d58ef

General

Target

3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
Size

83KB
MD5

3981090169b63eb42cc83c04b179cf90
SHA1

4920c4f2c00befc2d5cd75aecc04339a36904df7
SHA256

3c88b52eccccfbb5ada039afa6f74a2350053ceef5db9852e99b38c03f3d58ef
SHA512

a5a7e06d53140ca8a40f5635c1672ada9bbe350e524157e46aff7adb0deef4f57b284655dd5840f2c3f39c638237989acf8f441770f324637436dd4550ead304
SSDEEP

1536:W7ZDpApYbWjnWf05PG0PG26f0J0aT75T7J:6DWpDWYPxPMCj

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5000) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_elf.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\nacl_irt_x86_64.nexe.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3981090169b63eb42cc83c04b179cf90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
Filesize
84KB

MD5
da30fcb3f4a26a94b38fa1826103e3a4

SHA1
b7a1317ee32435ec76e935bc2addc2fbcbbde3e7

SHA256
f3dddd72c29b6faba843d38809dc394a6e81d8fdc5ab9bb71a81c1db5a579aa8

SHA512
b744ff8db3de79a03a22064342004bac82d94010444708f87717d2d3b9d1553070e19da003e4b2691b9b2d129c9c1771c8735776a5bbf68975953defcb98bda4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
182KB

MD5
23392cb2703b233105a50c0daac7643d

SHA1
2ac6ef3fbee8472c70fc8ad02d21281e51f1ba11

SHA256
53fba655c3d72ee35b15b6589008e028e964b76dd9e0facf431058a32da1742b

SHA512
1feeeea424a9475f587d5a087c93837237369696214171841c257ea29bf4e8138df04647abee6c729a74728e398fc5d88901f53dbe85a9d870951dadde818979

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads