1c4d2eefd9e1a550cf5fb1fc5608fae4842bf8df580b1b328ccf5f9ad054c4dd

General

Target

18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
Size

85KB
MD5

18b54ef2d38949827b32b5bb55df0910
SHA1

59e75b8d871f54948f50f9391c2334e97d474068
SHA256

1c4d2eefd9e1a550cf5fb1fc5608fae4842bf8df580b1b328ccf5f9ad054c4dd
SHA512

62b3ba2aab5e3179cecd385e66062fb50674ce5891a4c15d40057232b8b75ade15f5eff3ecc051a8f33f8613c3eb5bbeab7a62998f05e33853e80bb9057594e3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXau:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5008) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18b54ef2d38949827b32b5bb55df0910_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
85KB

MD5
efc33dc913a3ee8c99e999a57d0adfc3

SHA1
248bd48c47b485894018ca56150a973e33d20cf1

SHA256
4d3d4e077d8c0e01cf117e918882e3548e435041d978ee0897d9ce29a85c1fe8

SHA512
a3e06b99709d39a5815f85088d22b54a0fe4f253711d17fc653525c74d7c0faf718bb08ff9db09b801a084904df2fdcd1a44b5c27ea0e698bf5a9d7a63b6c3b5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
184KB

MD5
fff0a22a0bbd3d1e3d657ee91f5642c3

SHA1
8dd2860cae56bacbeb77be2d9a6fc36c3cad39b8

SHA256
ae4d32a2c77bce334ab7d0ac970552318383e60e48cd6de045ec0231f03be3cc

SHA512
87129fed730726611f44207227cadd3651428f2c5e339a2ba0c26fa57ebdbcdae73959fd56751f439733b0ddc64f9b5476c811cbd3257d89f730b1a9e0e403f3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads