a19e231f5cdc133f807598ed4c30bb2a1c815706678631d1ee090f6f33eff647

General

Target

4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
Size

80KB
MD5

4b5c359c82ba377e4524d40344e2a160
SHA1

626629743c1d06c98b0c027c8e0a5fc69de7b9fd
SHA256

a19e231f5cdc133f807598ed4c30bb2a1c815706678631d1ee090f6f33eff647
SHA512

443b5cc85f4d3d57eed52da61c02fe48c61f5ca487b9c5018e0d6893e4f57b573310791f65c51d72f421e0aad63ff8d12f9c1ffa9169dd73be0533452840a985
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/7uH9uHt:6e7WpMaxeb0CYJ97lEYNR73e+eKZ7udU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5087) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b5c359c82ba377e4524d40344e2a160_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3608,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
81KB

MD5
39faaf1c9c12ecfe389a7671d2f271bb

SHA1
bbcc37376a6d1d8f77c50dc9167ee8e512d9454f

SHA256
3d149e9e247e76b5eba491ecc1139d22c7fe15bd2e2e8c78e1d20f6c1c67e6e3

SHA512
956e9ad5048779ae98f4293fb8e411ca2c1ec22b06407ea55a7c06f3da7db6e473595ad298b163d57af782030f0b180a0fdf8acd523ea108cc8692e7b8cdf922

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
193KB

MD5
49e0da536d15f25a8e544e80e524a854

SHA1
d1a38a12e2ea0f50718f778d07bf42746aea214f

SHA256
e2d05468a82c51c5d3a27f15f7ad51c77d1ab8cf58062d51eba227832b8db4ec

SHA512
2ed3a33d263f562deb0057c6daa5712033687d656c055c0c34d984da45dae5b06f8460988b9fc8e972f6909b9ca8614fd8b3f73d0a0a7b88f96a8e1bbd2fc6b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads