980b4644d3739f4c6e4377951d496d1262ed682322abc04d9ba4e0b043084493

General

Target

707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
Size

77KB
MD5

707004c65ccd071181e77c0f603277c0
SHA1

347f7fb9ced9796e6a4425deba9b01b414005ff9
SHA256

980b4644d3739f4c6e4377951d496d1262ed682322abc04d9ba4e0b043084493
SHA512

9d224135a6cb6df345cf16b3b290b60cb80e0fdcfd309d9125cfff06f27958059c85670c4f63216ff4bfadfecced9cf57f0e15721e6f8534c2c9c994b47e3419
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2:6e7WpMaxeb0CYJ97lEYNR73e+eKZ2

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4855) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\707004c65ccd071181e77c0f603277c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
Filesize
77KB

MD5
2f482b980e60b2b702dc22d5770d00c6

SHA1
4d9a5d209fb64e84dd1b5580d7789cd571ddb84e

SHA256
aa1e8739818345df4aa60d04f5c541d596d120770b1f8cf5577b7f37595e1207

SHA512
ae1308f13cd66fa273c2ff43be063de3d60e931f59e682479559968667289303b9e539f56bbb5ed2b4f9ec04a5d6eedd7436b43a2476673d4844bb835aca178f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
176KB

MD5
9c921edc37a93ed649bcc8d6ebe6c079

SHA1
0d6afd6ae4a7fb878e4b385f9f03c08ebc41fa4d

SHA256
ad368397fe93481475a31f32c586410ab2ce0cc2882493710486a2939f513c62

SHA512
35fb682cc4d2f907167fed94ecb7ab6f77d6f43bf03fd47c5c18da008c902fead288701724197f08ad4c583bc0527781706c5431683fedbed723fbac91eea0da

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads