099782bb166041f0493f82dac398081b08bcd9e627f0f9dd3e66a02ab14f3935

General

Target

47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
Size

94KB
MD5

47b949ff1f3d152ba8a7152fcd2dad20
SHA1

b11737bf873eb31a65881617d00658ea7d20f492
SHA256

099782bb166041f0493f82dac398081b08bcd9e627f0f9dd3e66a02ab14f3935
SHA512

b494dbbf05ff8efdee3217dca5fc487470c102b280c91262ee135b774320c98dba5a7989a6aac95294dc179195571a8660c051b713e2b72eeb079567d3599e14
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNe0A0n:6rWpcOPxPke+e3fFpsJOfFpsJbgEU0Ao

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Xml.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebProxy.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsBase.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClientSideProviders.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsFormsIntegration.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tools.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsFormsIntegration.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Ping.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Accessibility.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\PresentationFramework.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Presentation.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Buffers.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Expressions.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.Lightweight.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClient.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationCore.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationFramework.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NetworkInformation.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Writer.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Channels.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClient.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\ReachFramework.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Xaml.resources.dll.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47b949ff1f3d152ba8a7152fcd2dad20_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
94KB

MD5
241a46d29171912c2a28ec5a6d8f101f

SHA1
1e957377a2d3d27df6d56754cdfd98f84b7a0d48

SHA256
9b40a7297868ad410f7c471f728d5810fc4dec1f686c18c6945cdc020419efb8

SHA512
b73478ea0a00b01be2ce5c20c2a3dcc20d438678a582e2c25669fe08d046dd904df61fe8a999c03c44ffcc7c693308fcc77c505692e2f1ec8a0715abe4b98dd7

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
94KB

MD5
a3015b5009ffb3646113a2690249bdf2

SHA1
5ac406e32bc766a78d4d6188f5b849de27c6c308

SHA256
417b71dccb1aab373bd1eee2a2178aa62266f523a672ae382bc71ea37bd8c29b

SHA512
d5cbf3bfcbe478faf35a9d9625a29431192d03bc019fc4fe08271fb18b35cfc8c825217d8d3fb29c6e08196ec318156f63b2ae2de62e81de278d8914905dda0d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads