eccd7f9a45b398ecf46a8607ee3d41a4d63a819b1da1df38ff36d37b5441e4e9

General

Target

681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
Size

79KB
MD5

681641ed7babc51f3f867c82b1a19270
SHA1

b8bc4362589bfa9e3d2413723067e7569551a337
SHA256

eccd7f9a45b398ecf46a8607ee3d41a4d63a819b1da1df38ff36d37b5441e4e9
SHA512

aea0853d4c5488fb0c74b8971c26f88456e17677d5240c43a60e0133bd537f70db1c1465645588e26a6554efcf27088d7c368f6748fb333721dcee5c73a5c54f
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHz:W7ZDpApYbWjIlE77ufL2e+efZwZavP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.tmp	681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\681641ed7babc51f3f867c82b1a19270_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
79KB

MD5
be0155baec5aee1ebc1a3184cbe66601

SHA1
4fbbf8409a6ad14b78cbf38f4c60f979167b877f

SHA256
fdc992b4b49ae07adbc09f34d831e357b398d3f710ef471dfe0ad3f7dfcdd136

SHA512
a1b80089343e9d614b024bde681b0314b42f1a0fcf99d96eb05b2a1cc8c1d366e95c99cb3a43afa7ddef4ce2ca25518a3c6ea8a21e46260d25a36d176fdc5c7a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
178KB

MD5
cfec9c2166ab63b3ca75c690c5003686

SHA1
146ac99da51241526172cdbb82572e5458f5c054

SHA256
b06de835e1b6819dfe532b009cf64d1b5d681d7b8ddd3c4a7b611ef47ae80922

SHA512
ab7615114f4cb4b781427740fcc7b5fa3b991e783c44aa0ab46a729e2c162f7af24be35515bed4bd6efcb9ecf030ee0336d025f8c478f126b998b726935a93d1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads