b6e3fd25b5140ecf87289e54913cd37d44ec64d928172f548baaecafcfe93e16

General

Target

00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
Size

85KB
MD5

00a6385e71a71c9e053850307fd42630
SHA1

c48c2d9ecd870424824778a30490a6f0d4e7ac90
SHA256

b6e3fd25b5140ecf87289e54913cd37d44ec64d928172f548baaecafcfe93e16
SHA512

449a2c982af7582e0f59c5a6e65754b9bada95dad9607a22e4c80c177ae9b0ea0a338c994f619e2137f4d656d84021e515dfe7420fda90c02ca934cb4f3266e7
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hH7:W7ZDpApYbWjIlE77ufL2e+efZwZavv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5111) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
85KB

MD5
ddd0ccaa4c5045ab6ddd38a4a7ff94be

SHA1
562fda8d6a38bd0ea4ab7c6cd868b64fd9240086

SHA256
7bae353cfc326dea406172cbf7ef178d685cbda85d94a55f83f4e302a56e7998

SHA512
5aa44cfb6c0228d0e3198f63b949052b8ac322c111756ce007da909e21122eb22f1e44c7988586a6fa94567904ee3ba666c5d11d15e56bad6e91f9a12514bf1c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
184KB

MD5
cd16a78592a3403437954a020a436efc

SHA1
aa2d20e2de5e024cca4231b8d8221bd036218208

SHA256
05ea1d4a481be6b22f9d42ba48115ae47056b8533d9fd87aa73fb53dd8876d08

SHA512
292755d56b70eede01313d992292890fc223e115e68efa1a974b434e73223a414bac6cb048881ee5a9e5abe45939eb885350d8ed49965cf5775d78f169631836

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads