0489ec0e9e7eea188ad51a32503cf5942dbf5bc3cd8e5c23c79e395644a80613

General

Target

6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
Size

87KB
MD5

6b17331186a5cc3e08288eddb5b32e10
SHA1

27579e13ef1682a0ee8a0d48bda017132044276e
SHA256

0489ec0e9e7eea188ad51a32503cf5942dbf5bc3cd8e5c23c79e395644a80613
SHA512

4cd2f87f5de14f10dbed0b89568e38626119715ce8c49afd1489cf383601b3c7f3ce282fef1cec0ecb3f26b1864ed7c80f3c38e68380ae393dc7c2790195eb7d
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2v4FL:6e7WpMaxeb0CYJ97lEYNR73e+eKZ9FL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_wer.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6b17331186a5cc3e08288eddb5b32e10_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp
Filesize
87KB

MD5
61e9099b3f9481302b3fcd1e003e7398

SHA1
fd209fef647e7c9fbc49e9ad4c98c242440b6188

SHA256
61e3fabde7aba1d2d3cd078cca3879387252e21eb862b0657f4cd6590fadc0b0

SHA512
7b82b6694c4ba89ee40ce23d5a4169bc1195f30661866915a0e16912f6ce09a93bd2d32f8465f41d4f7d13f73e1cbe480eaca28692121bf78aa763c96fe6441a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
186KB

MD5
7b57557819cbe4715b3edfccc28964ae

SHA1
5adaa2a7e3531bfa660dd1359ef1067827080b7e

SHA256
078278eeabb764c17b2c61ce68aa8f659696be9d6fee78232264cf335eb7ce48

SHA512
5fc6a7f23e87aa108670c190fb958a9c4489aa85c237c8acd6613264895ff7d62bec5bd907f6b04b8a7079180be6172d6745497ca01cda8ca1cf6a82ed88166a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads