ea627203ed673eb534e28066a1f406b8f03af070d7794692fa529c4e33bb0bdf

General

Target

f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
Size

84KB
MD5

f3a843836de759d81cf8a15286d52760
SHA1

2ed0ac1626c1ba233f281cfa09167c22d77591d3
SHA256

ea627203ed673eb534e28066a1f406b8f03af070d7794692fa529c4e33bb0bdf
SHA512

e7271025b56e88dbc8bf587c6f807d24f63ef707ac86168135e79ac2acf67ebb3c51f4b7c46d508af60e85d3143c70471167e063156e98a9840cf55e1853f09e
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXarW:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5039) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre8\lib\deployment.config.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
85KB

MD5
75257a2973a7e70989507b0a9dca017e

SHA1
732a8a7b97d120a4f3bb78c339d0355dcded0140

SHA256
975124719a75b97646af188be7f5d4d0e54ce5b20bcdb76292641b678eda81cf

SHA512
4ba3d62d377aa39449fae40846ad2e059a47936cb7cc7b79f91ebab6431f2df74b8c67402195d7cca61b786bece060595e7c4c3fed02a0dd8dcff3316487a160

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
183KB

MD5
a7f00d881d3ea71c39420d063bd979d3

SHA1
7d3d5c3609dea75d1e6b58c4601f7b9cb710c0cf

SHA256
b2bc6e70bbd788aef30f5cb735b75ef28460214c714bd2a7547f712e39d9c251

SHA512
62348fc6007cfa9cdd8cef9f7ddc516cba5741910d946b25db340a32c3993d128977cab1ae12e5adf6ae17855e54082d7f4a72bda59685e0ac2f4b166cea7bd4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads