5eb4abb028c371d35a78248107350fa8739c36ecac3acf60859faa10564ce2d9

General

Target

3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
Size

82KB
MD5

3b33a83ef62695c82e2875d16de27200
SHA1

4887df3fa530f9e4cf02951109deea1513d44f00
SHA256

5eb4abb028c371d35a78248107350fa8739c36ecac3acf60859faa10564ce2d9
SHA512

80a677f34817afa0c697ca81d280cad5c9c943250dbc99f9e72a7c54787ac80b311b19659b0efeec3f6ffe8c201e3c82167ef9e340ae2d377f36227edaebb69f
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhh:6pWpUFpEhLfyBtPf50FWkFpPDze/qFss

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
82KB

MD5
83503c9dab4a9f47ab31330aba92fecf

SHA1
bbc71124f24b7a0d2d40ebb0406a3b1dae769ec2

SHA256
7ab1084376a967abfd50abe802b1d2531bd8a6774347806d3ae7efd766ddb273

SHA512
caea2b7e82917deb5714ce31b68b2661e9f1a63473aad6a3aaabe706577fbebd097d3bbe14d7e410bb9f4faccb4ad93062e1d6f017bd85d6d034c30a7d0b0d81

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
181KB

MD5
4d58ff58e823ba1d020552609633af03

SHA1
31a14303ef4a8198848f9cb3fb468b9f099bc35b

SHA256
19bb224b6138257dac6ec73d0a197417b310b973e70a2d4bd03b97e4a0b69a2d

SHA512
98fe04f1392d4b9507371031e404cbe8d834798abcfd169993c2aeeaa2f054fb6fbfb71d5bf2913d6d9b573d5a3bd3404e08f01946a80f811a92408989bd7884

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads