e5400aed2f0ab80794daf2a30ff6d7946f697545f0903abf88d1d5307f6ce982

General

Target

4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
Size

80KB
MD5

4b9c90bfbada1aafe3c1240a07095cc0
SHA1

16579832a7eb45237a539e01ad1fdb98dd950ec7
SHA256

e5400aed2f0ab80794daf2a30ff6d7946f697545f0903abf88d1d5307f6ce982
SHA512

1268b95f9d5a8914e0976d5dfff3bbd94a1f6a39877585784bd0c759eee2fe838c2a6811b376ab4a51fc8674500eb196341ee31107b99de8d13686a5d3dfb915
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Inh:6e7WpMaxeb0CYJ97lEYNR73e+eKZc

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5032) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ko.pak.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b9c90bfbada1aafe3c1240a07095cc0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp
Filesize
80KB

MD5
91a62fda03732cb5a0d26fd80780fd1a

SHA1
6a452d61b04b10e7ac27e2295b1160bda5cfa747

SHA256
5558c69569ef0b0d01e6a2aa0b38ebf076faea3e596dbdd1e1c0dd9a07e1996a

SHA512
13ecdd240065a4e724087717ef9dc35bfcdb1f572dd1af66e91a51389d5a611cd275609a0d1837afe57496692040adf2e1244315d8ad568ec243b57f8e08a63c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
179KB

MD5
fd323be00c51fea5794ab59065b753ca

SHA1
a876fe709fd3a0508b9ce10714149a27be535b16

SHA256
68c11085cc8f31674157a0c47ac6e2bbce8e266cc7f6c085887b715040ed9fb2

SHA512
9e88ebd2c3334d7dadd2c36a9ba794ddb5ee77623d32776114e8dc3fa179de2b0f9129cea6cbf4ffe588b723b28edc7c90e0500b55a2a2fde1890b253500822a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads