0c8b21f8e979b05fc4e1995907b9052ededfa4c9ea9bb30468be7cebf5e60306

General

Target

2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
Size

44KB
MD5

2256b7c192a4f42202d55805f4035d40
SHA1

a74109ee5c67b74c3be33184f6d20d2de49ffbb4
SHA256

0c8b21f8e979b05fc4e1995907b9052ededfa4c9ea9bb30468be7cebf5e60306
SHA512

2493554229f3c79dd92fd086e1978be126aaaeac74e12a9dddb4081b50a952406b11562c4d25dec13c27140f8a5c69093f90cadb8621d44f0659ff38248d0dbf
SSDEEP

768:/7BlpQpARFbh/o+fOiJbfo+fOiJb4JDYJIJbVT75T7T:/7ZQpApVZM+etVT75T7T

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4719) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2256b7c192a4f42202d55805f4035d40_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
44KB

MD5
60c296189b8a568aa8464341ab40e46c

SHA1
d511299469370b4b26352636bffae2df2eb01238

SHA256
00372b55349fc4bf3ef39ab4e26ee7eca09b5fccefb14c9645af621999d2e2a9

SHA512
6dd76939eb732ee7e41bd716901ff85527def6fbd34cd6d5403e26c4084065ce402e4d60728a6d61b03c53eb421c342da6b4c55090af46650b7977498dcfa1ba

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
143KB

MD5
6a344adec8b4de43c47ec4563d852aa1

SHA1
1df498ab0d0a6cd7e5d2bb686767078bde786289

SHA256
633b9767013eb9279496ecf35b20552b33afaae85d54800e0d3e2d46e69494d9

SHA512
a9093cde694cc6515ad73a62e16ddc3103556b0c9988a521da3167fa51c9eeb629daa7529da0494f1f79410275f3284a3cbe4ef2ed25e5b5906321d658e8a88f

Download Submit
memory/3224-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3224-1728-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads