b1a94539d31ecc88d179b402cafc71f8015c9467b60651a3f201af97e1e191a4

General

Target

742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
Size

75KB
MD5

742fcdc54219b15fcb1a98f73dc3f950
SHA1

6893ef7ebe54bbb5a71f3883909768406b0b8347
SHA256

b1a94539d31ecc88d179b402cafc71f8015c9467b60651a3f201af97e1e191a4
SHA512

816fdf1a0b5b6c2f2722ae6c3596d513652acc937b50285a0d57a27b3ab46edfaade80250c14fa50326167c5a8a5095440c1ce308b71d4d12cf283593a4fc202
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhn:6pWpUFpEhLfyBtPf50FWkFpPDze/qFse

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\am.pak.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fil.pak.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hr.pak.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.ONENOTE.16.1033.hxn.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\742fcdc54219b15fcb1a98f73dc3f950_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
75KB

MD5
4690f0997054668b597a6bfbb2626cd4

SHA1
9d0bdfa5f18ed87c9569ebe63cd7252fe46110a5

SHA256
765b353a093b20f0fe1f48e6bb063d95c5d99b89ba0a631c2d001399eecf2e2a

SHA512
83dbd556036777b34244175a44095bd8a77a809317f95bba6ab85320336d4ba0c1ea977749cc2741f25808ac42f03296b016ce5d74c5b2dbb25afaddce41bcd1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
27d93581fdc374cbdd9a4e1aab5f925e

SHA1
f5ea3329beb5d15bd8e95d7d6e97ca6e469fb0e9

SHA256
c7a0a221a8301422fedb18d1c04728ad84ba1fb415d764bb5fd8763540fe25ef

SHA512
0015a9a804449dffe40ea2f72b74d676d5a175e634cdd9e67b9bf5f367b16797c8217cc0a4b169c983e0f2ee2fdbd1779439060f40535e684eded137cf94a150

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads