55be583882664e7fc99a582e9af1d385151a28efe628492df125af16b6f884d8

General

Target

813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
Size

82KB
MD5

813ebde304c11ea296a66ea152a562a0
SHA1

93c813a28c80e62aab7b68cafad027e8f00c3a91
SHA256

55be583882664e7fc99a582e9af1d385151a28efe628492df125af16b6f884d8
SHA512

bebee714cb9b5e66da33c63018ebf841efce7c22bae2580a82637ef42f0d52cadbb3cd13513c4a5484a4b053f1b9320df4c777320aa049aff31628aba5e4d179
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7GljAO9iOghZ3yAO9iOg/:GBt7Br5xjL9AgA71FbhvoBlcQ4NQ4/

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Registry.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-utility-l1-1-0.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXml.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.DataContractSerialization.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationCore.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.ServicePoint.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.Design.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.NonGeneric.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Queryable.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Input.Manipulations.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationClient.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClient.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationFramework.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationTypes.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationTypes.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\PresentationUI.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Controls.Ribbon.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationFramework.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationCore.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Xaml.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-locale-l1-1-0.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationUI.resources.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.NETCore.App.deps.json.tmp	813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\813ebde304c11ea296a66ea152a562a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
83KB

MD5
2507aa0e2a84519f74a72fc867da3006

SHA1
d6460065f4a912ab028fa214d90aa5dd67c10b75

SHA256
591226d2841eb3c1becf0c248604dfd281308a40108a2ca2970f9fdf36ae2065

SHA512
057e39ef35df8734a5329cc8fbcba30ac820dd8f59890e8f21079fb245e59ad055acabdd061ac04a298d691b9942fe4cd326518a136608b83d70bdee5b4876d3

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
82KB

MD5
75eedf329bb6f355a2db22ca71092b68

SHA1
478f07557995623e6df6005e3b51fcd4c5247336

SHA256
d3b515b603cc25c8e746fd2a3524f3c113db31aebbd0c5275a99dfa54e8fad72

SHA512
809562b43aa7e54c2be038e32c5f20f416b684aa88196068bab58aab3a36e34d2442c9f63353cb53375a88d48d30a403739c209800281fead3c2190de7735404

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads