d55b1380911e649540f84c31e1f9223de0e20c6b42efa6eefe2f2bcefd567205

General

Target

9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
Size

87KB
MD5

9f9c58f994e5d55f00062d5b4bda10a0
SHA1

ef7d2e8434a2177b1ac2dff5848f2a6550cfc46e
SHA256

d55b1380911e649540f84c31e1f9223de0e20c6b42efa6eefe2f2bcefd567205
SHA512

380b6c6e22b8922ce55b7fc3cbbba6f4316ff599bad76f7c62a0e9215818dbdccfe862e62df6fc4075f17e90e35117b24178292f750b07c0a8e60b60944f1006
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhq:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1628) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Primitives.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.EventBasedAsync.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.VisualC.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Native.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.Vectors.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationTypes.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Xml.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationProvider.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXml.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\PresentationFramework.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.CoreLib.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationProvider.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationProvider.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsFormsIntegration.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Ping.dll.tmp	9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9f9c58f994e5d55f00062d5b4bda10a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
87KB

MD5
89d7c80a06508ad3aa73470eaadd0309

SHA1
3cc4743dfefe92fe91e16112e863ad2abc427083

SHA256
befc5e13117e001fac0f987cd0cf2b71f21318689fc91b378d9e6813b6c48cf5

SHA512
a6d719b8d1ad4cd7e9f4ab330d5cc8b2d89463560f6a9ddf02b5efd0aac88bfb2be09832d9563a3803d078beedd0d5c36325a1cf9b06238f786257d8dd81533f

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
87KB

MD5
4f1130d626781695fad4da9c8ad17100

SHA1
96a5e27d005641c2d0d27a47e75f3599868a3c3f

SHA256
0b169d56d5df2be0101ec28d63b0670c241e94f02e9a4c3cd7eb5e0ead750948

SHA512
3ebc73a4d58f6149cfbc3556bdac3237e2179b4541bcaf606c6c3f35e77165e068e40cf238b45cb1b5d9428ca71303eb29957d3d837804f83a736423814fcf20

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads