efa7f935b7d91f8f707d481f867a59db6846d72c6b73ce323e6eeb8f3e98e51f

General

Target

3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
Size

91KB
MD5

3b0fbd5f1d8d760548bb50efa5d6d8a0
SHA1

23992c2c4b26c0df99455b947ae329f7fd855225
SHA256

efa7f935b7d91f8f707d481f867a59db6846d72c6b73ce323e6eeb8f3e98e51f
SHA512

7e6e194e8ca01692fbe771b957090ba197674cb67d37421ee1eaa4844c28a5bb65678d291974af2c9c6ddbc2bbd72fb236a925ba9086fdb815c63b6c1ecc44e6
SSDEEP

1536:W7ZDpApYbWjnWf05PG0PG26IvxvWyCUyCJJTfJTO:6DWpDWYPxPTJe4k

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (766) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Primitives.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.DiaSymReader.Native.amd64.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClient.resources.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Watcher.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationUI.resources.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Controls.Ribbon.resources.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\msquic.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XDocument.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Sockets.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Controls.Ribbon.resources.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Json.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp	3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b0fbd5f1d8d760548bb50efa5d6d8a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
91KB

MD5
2e4602f107af23ca58af36bbde2cfcc2

SHA1
e05cb6496538e047be874bebbe2235f188593e65

SHA256
86cdc532b757b67e7ed345a40eeaff2dfec6d2c46f0f6ba006d257f7876fdeea

SHA512
0fc3245216ecbbf55ec095283a0b80468ee4d7891658b9f013109c0578d658c969b5c767cf5de807e0d7989ef071b2457520f63d3fd3cef7b67535dec6658a3d

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
91KB

MD5
0b085a664e770f3438dd73ee007a2a0f

SHA1
a8317a51d7395147a286154e8dc5b8c579a6c5c1

SHA256
e6068bea6d75eea039c8c64f6157934ba12f68609b4877cba9725d350576d87a

SHA512
5d000e427d71b1d17c0ab951d258ed49ae39670c56a85320f2ce430efcb45ee38eb931372d580d2994f88d5061857fa32f785821340a4860443bc7b600bdb479

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads