ab5411eb02e84646552e10875706abf50a71d05a6448504b14351147bf9c00da

General

Target

07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
Size

81KB
MD5

07d73ade071bd49840309e628be70fe0
SHA1

bfe1aee0d17b593bfcf157289ad2aa9e57910df5
SHA256

ab5411eb02e84646552e10875706abf50a71d05a6448504b14351147bf9c00da
SHA512

6983f8487d8a92fceb1358c5d24212901183afeac437b49d30bd60208c38abd628cd3fca94051b3502aa928779fe506ee085c7aff9b0b2b59dabf125190b27c3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/6lDW:6e7WpMaxeb0CYJ97lEYNR73e+eKZaDW

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4874) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sw.pak.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07d73ade071bd49840309e628be70fe0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
Filesize
82KB

MD5
245cca4d8796b3dd74da40463b8dfb85

SHA1
97b0031976cc0385bd4ac9fafe1eed222ade6a5f

SHA256
c311ef4d37e2963100247c6e0ddd0e8cb20ed7343bebc19aaeab2b7c3ff3f216

SHA512
2f5848adf22fdf690fb9218459e08b6c4da65978e57c3fab4264a7c3cde932769542829c848f08a0f236459403d20671d9c9bec1f259c7d758154f1b47e093b0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
180KB

MD5
01564a41ebaef36b2f51d8f7e1c3c3c7

SHA1
abc4afe1b934b00f7fe942749f21c2930d49bd38

SHA256
eb0f2db22e04692db7538f33dc582299003f01e553fd0a28f4f1930bd3365bf4

SHA512
55efae0c23ef01725c649ef41b88630ac1eff8abafe8f37305437c22d7e3dfad23b49e9d6e61e77297165cca3b4cd6a42eab3bfeb1fef600776933d9977df905

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads