c9737534c0fc23d3d6ef5068676f193c3b4e63eab65cb86de6fa6cf6324b9cef

General

Target

51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
Size

84KB
MD5

51ead86d9a8f288d0d85bbb592584e40
SHA1

56b7acf2290af276fe0ffb475b4f04e0bdebe037
SHA256

c9737534c0fc23d3d6ef5068676f193c3b4e63eab65cb86de6fa6cf6324b9cef
SHA512

426c3c4557490ad095b5aa6f1d7cfc9d13bb5f770fb771f88b4384f6a37fa7a134a14b79853787a63965c6b8907981e2442b06f83ee7ce49db9de855cbc4ab88
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaW:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\ExpandCompare.docx.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51ead86d9a8f288d0d85bbb592584e40_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
85KB

MD5
31c3756004ace7bfdd810d8a7cda6509

SHA1
d97b7d5517ecefb783009f43539ea0764c02c5bb

SHA256
04189e75d86dac1f9484bc28c9e29736dba6263d89ada937a92e1a06ae96a6ee

SHA512
41db1fccfe773eccd768e14351ca9c82529b4b7934979805b3439c305a9184aeb533bb439695fc84e4b85ff451b6135d25a8f1c1ca5719a1a2f6a8525e22bfc3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
183KB

MD5
de7511a123d5bec0107531d9b8be1f24

SHA1
94be25d9306211460180950409b95243e7442828

SHA256
66465fb9acbe0457c3826c898629c3d352af6d4e09a4df08f04e15203fda2ea1

SHA512
901c70e15c2dac701140dd4e55df4a41ee3ae076fa0ace1a6c53e9ca3e8a2c9f158b22f81477c7d3f8443e41ffb99e92929f5d51e9cbe760f9d9a76c397a1540

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads