c8fcd5ade39f276589602500ffcf8258734226c7524091ef208bb62197df9e48

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
Size

86KB
MD5

c842f1928e99d85aecc1a035a8906da0
SHA1

19a787064a0e5dbd21cef3fb6d19505426447d35
SHA256

c8fcd5ade39f276589602500ffcf8258734226c7524091ef208bb62197df9e48
SHA512

e61b24ea6a88e60f3722d3b1e4bf2d40afcd035c57f7f5c141f83af06cf429eab4f928036849338bf16073af0108d087e4f10ff0f6fd97dca14caa6717ba076f
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRec:W7ZDpApYbWj2WTWJe+e/qX7qi

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Primitives.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationTypes.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.ThreadPool.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationTypes.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.CoreLib.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationCore.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Xaml.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsFormsIntegration.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\UIAutomationProvider.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationCore.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Common.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-profile-l1-1-0.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Design.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Input.Manipulations.resources.dll.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c842f1928e99d85aecc1a035a8906da0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
86KB

MD5
1464ea3b4b8a3084dd4ba58a066ac299

SHA1
b14cf31a9cb5798810ee9e7d8a966f1337c5432b

SHA256
9cdac8f6ba2509453763759497f1fee9473c49094c972ca0a9928abb66bf2ef6

SHA512
ac760cebb3e90741e70aa17a91370e60a94c5babf246c5916bd3087c39646522575faa8f5921c37cd5edea31566967b46c63de2fdb0d0266e77605bb2cd31bd7

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
86KB

MD5
0cdcc34fc3a48e2f9872bef89002eaf6

SHA1
239c0e86adce506b6f996beaa78dc4adf32f9e3d

SHA256
77d9f47fedae07720b5b9f24ed2f5743183758296bb70d3016e76f9aee96b2f4

SHA512
1be414f607c4dc8dbe715fd7f7fcc17e6cf48a6e0ba69b5cb87a1b671535c5c0339f25ae62c231d0b1f36eb3d28d2b004c89b3cc1e4a25a3a77d097b686da0f0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads