be317744c1bdd81e0c50bcffe5a34e7791b1ae1b344f35534de8db740c4d7207

General

Target

4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
Size

76KB
MD5

4c346d6aff97302ace6851f04dc27300
SHA1

4fb7f31f5bb8077d601893e29e35c024005d2fbd
SHA256

be317744c1bdd81e0c50bcffe5a34e7791b1ae1b344f35534de8db740c4d7207
SHA512

9d41fa1121d8fa721849b5cfad9db14dd78ae4215b19c7b073a7ad84836af2b79f71da2edcc5dc7a9d1cdd1d311cb606fb1a57aca76f54fa48d1bacc479ac860
SSDEEP

768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJk:W7Z9pApQESOHepOHe8G+6E65TGA3vs

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1561) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.Win32.Registry.AccessControl.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemDrawing.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Primitives.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\PresentationFramework.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.PerformanceCounter.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\ConvertOptimize.i64.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsFormsIntegration.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.Primitives.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClientSideProviders.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.AccessControl.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationProvider.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Buffers.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Asn1.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Primitives.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Xml.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClientSideProviders.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.resources.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4c346d6aff97302ace6851f04dc27300_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
77KB

MD5
fdadd2c907dd01a389bbb5791fda3557

SHA1
7bfe2d986501ac503ad33d57f25f5f1e82f88bb8

SHA256
f5d7baa07b3d07c897cc277a6c063458bdf4a366bcec002bf5e132566eca4d67

SHA512
3a54315e2832892188543b4d506a5ca1389411561786c41a063f8020df5b3f0aede7801af0b645a2904a26163c1228a34b160237571f19bf55feb369f06cd9f7

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
76KB

MD5
d048c321e812b31821faa5cf4db082e7

SHA1
e8ddb9a92cd676f354e72fc3468b793b00c0b92e

SHA256
9d840857b6105e69277d5fdbc195437827b5992e37ae0c357b4b3cd8028b129d

SHA512
d14024bcb2e86af609918ccf580988d6432f05a7b1b771139d87a8c3fddea00bfd4203dac3a0a6f0fd9bfd1f5990bac6562ce8a4a08cf5b3a797a1dc0277c171

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads