e5400aed2f0ab80794daf2a30ff6d7946f697545f0903abf88d1d5307f6ce982

General

Target

4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
Size

80KB
MD5

4b9c90bfbada1aafe3c1240a07095cc0
SHA1

16579832a7eb45237a539e01ad1fdb98dd950ec7
SHA256

e5400aed2f0ab80794daf2a30ff6d7946f697545f0903abf88d1d5307f6ce982
SHA512

1268b95f9d5a8914e0976d5dfff3bbd94a1f6a39877585784bd0c759eee2fe838c2a6811b376ab4a51fc8674500eb196341ee31107b99de8d13686a5d3dfb915
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Inh:6e7WpMaxeb0CYJ97lEYNR73e+eKZc

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3630) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\slideShow.css.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\slideShow.css.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\firefox.cfg.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
80KB

MD5
3f956357bc66a95fa0429635eab852eb

SHA1
974491fbbbf58402fff52c12041225526576415c

SHA256
d33d8dcb5ba8e9f9604bfe14accd8f2f695b3a41c959fea7f96f5fea28eaa759

SHA512
d22aed80b7ef2208d540e589ac08fd49f914ca456311f4a10dddce5534bc89504e85dca519c68584fb5d22f0ce1837a0f49fc63efa2e850b96320d616c2746bf

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
89KB

MD5
13e8db56660660773e6b8ac69effa89e

SHA1
19f26201dc3f6afe9b92f066010bf467de4cbe2a

SHA256
c9b0c41c61283e583163ec89da1b15d2c4e915cac0e1c7c94fd196b2699f5d3d

SHA512
248145dbebdcaec375e0d5f594e15ca985c3a6478a11b60d25a4b0b35c61ba723038867a6bc9fca7799386f767f42340c9ca01b504eebfc10c14dc72aeb7342f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads