47134b323ef38133ce90ccd0cf21801b703c935776d427a45dd54e37e3423fe9

General

Target

c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
Size

86KB
MD5

c5b07d457a03bc4be0234cac51132e90
SHA1

ce37405c6285ade8a219fe366343bc423158bce1
SHA256

47134b323ef38133ce90ccd0cf21801b703c935776d427a45dd54e37e3423fe9
SHA512

f6b33ea50e34a93ed09c8a8ca12b941e38ae3457ae8fc58f5775007372e36c887cc572d81959caf5e05218b612cbec598f85098d5e7dad1a6f926c7fabda5f0a
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2vn:6e7WpMaxeb0CYJ97lEYNR73e+eKZa

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5062) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c5b07d457a03bc4be0234cac51132e90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
87KB

MD5
072f5c872199f527f2780b898559ada5

SHA1
2243e498b92dead7d1832f1587310ca2f3057349

SHA256
fbf14a0294f6f31c5c111626206d635f6cd65c73dd0624b2e05e9dac2b9bb0e4

SHA512
182ec1dc89610f8668c8ead2f905f5e4f8534990d6ffe4cd264628b82c3ccc6f832b78c2acef4e94779dd34669d61e289ee4b6a1a486ea7f737b402e5566b344

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
185KB

MD5
47cb17bb7e5a9bd5207d0dfbf8df6ba6

SHA1
9b4b78f493a47e438d7079d543d802199902b2d5

SHA256
70dcbc82670e806fad770d56d3b27dca425de0366f6ddb66e83c953747b2be1d

SHA512
5643a03feeb95c9aa06dd2c3c378200ae334316b8d84c57e0bd2b5c3aa4b2dc0546de4990f383d384be8be30bfcea05844353c46bd82908f1a8ade2653bbdbcd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads