ae608a579e154adc1000c1a03ba2d90b0ca8d9723f26776faecef1d2020f5115

General

Target

5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
Size

76KB
MD5

5daf5ec699e54eb0d30f4f6287f696f0
SHA1

2d18c6ffb7498effe30ae09ab48e3b102b690f1c
SHA256

ae608a579e154adc1000c1a03ba2d90b0ca8d9723f26776faecef1d2020f5115
SHA512

5eea705eab4cbf470e9d50480635c7076a32d44a0c1b7d6dfef1f3c712c88ee3bb03fb24e1790e9a0c9a7a4dca21b2b8a87ca8d5df862297f625b828e53a4460
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhV:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsQ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5daf5ec699e54eb0d30f4f6287f696f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
76KB

MD5
6d518aebfa678a823e8fee628b76aeca

SHA1
13e974b849607fe10f844bc081dcaa00cae0a228

SHA256
e08f656cab568420eac75bf42de155c29419a60e7e26abaae99020672fb9c418

SHA512
1f213f900425ceb2a975f3f7d831c9f1c4288a22c7b108509a5bd8ae1190c59dafa6959c682cb931d49d0dc9c17a7cf5675e9e8e17867a95629785e554d9281a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
175KB

MD5
a1ac0fb7fc3cfb89d16a0df255398030

SHA1
ae057af0bfe3d04fe251364e57fe0353215798ed

SHA256
58cd07cee8c7343caa9d4ea9d720dbd25088c49d04410794f9a1284eef9ac1ff

SHA512
700cf4923f23a9ff71e8822f16fbc4311315aa2fe0679b953870989e6a27e3a308ecb2c2b159dc699c70f1a8c493be8381ccb587e8ee0cde0a1d304b1ece0418

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads