808adfb7de7ff6021e65ee69e1684a429d53ff97a5a67b0d543e847b18887ba0

General

Target

6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
Size

98KB
MD5

6433074b1bbe9337e2523d8e3a3afe40
SHA1

55424c2ab7aa17ff4e20fdf7501d118680f5124d
SHA256

808adfb7de7ff6021e65ee69e1684a429d53ff97a5a67b0d543e847b18887ba0
SHA512

a1cb24532653f7a7c5bd531fc9b8a135afc7a0abe9ccb171b6e14143e0a009c410c816044862225599ae7a631da6ed32df7c5b66ac82a3ddda775494054bb7be
SSDEEP

3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEbThymcJ:tFPxPke+eIZyR

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5116) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6433074b1bbe9337e2523d8e3a3afe40_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
Filesize
98KB

MD5
65cb8471b8c8663e427da005645d77a1

SHA1
33af547958405c3748ff7640c834994aa1a76318

SHA256
eac1a39b3dc0adb6867683d54196899ce2127620f20939f12636e69c75960d15

SHA512
1c70475a40d7a9a27f179db21654ee8866547d03f73bbd6ed7af0e175ae7bc984c4feb01dc7c1048922e84c4d3f77911faacea0ac8d8fbd369aab9dd05b4cfa9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
197KB

MD5
c152d4f7a8df2f6c519f0a51b0a9ba8f

SHA1
7f5a195b3b55e3054c52292de6b2c8f404c8b18f

SHA256
7598265e3b9f9c360c3e39635ea2a3d77ceec44a003669669fdc5105cce179d6

SHA512
0c55a7a35031f1cf1b5896a4637f7693ffe053eec642fee772a3cf5244396d2d828500cf5b5318584df3aa86f5aed3d26c3eadd60e2e28cfc0bea0a46d9d725e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads