46ec0ae9927885d0a4d9af8358aa8e62f6400a672229957df6ec1f32a592e32a

General

Target

513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
Size

84KB
MD5

513d71eda71ea002c59d10e98bb018e0
SHA1

52070e4fba10afab112b3983154deb9695b2e6a6
SHA256

46ec0ae9927885d0a4d9af8358aa8e62f6400a672229957df6ec1f32a592e32a
SHA512

0b1a5c0f4c5ae7aba3931ce09db51c7c3025028da3acc151a60d8ebcec5848490457dbf98aad089ca693cf05d5f0fc20c26601c616c5b301eca77401f7bc2814
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhK:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3485) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.catalog.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\gadget.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\settings.css.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\es-ES\TableTextService.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
Filesize
84KB

MD5
8da9c751e0f513553f766b3f209fc963

SHA1
6a4917ab60b9df8d55641e44023fd18d45ff562e

SHA256
f9a2baf2a5d4ba42141c6dfe9a51e4d1946b5a410008e84e68b049316aea13f9

SHA512
b2a9bd53c47f544a56fdab9715dea9d7cad70c6f9dcb4fca507c6357d6a5f5d24e3086e67cfc60d76297bc3caaaff9a8044399293604fe580bb01b356a3591c8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
93KB

MD5
bfd831287e9c07e0243d8709870dd070

SHA1
f2d79a00d8eb4347db86c530fbf8c3d54bf5b12d

SHA256
8a152006489fefded7273bf09ba97c0f019fdf099ab351c94a3ad2d547c84114

SHA512
645c4ce985695819fe59f218d04ff384a59042e1712528fc50f3a4c202e39ece8b59c1e702257c7f3151302427ace7bbfe5c18bb1155cd421f68b55507d7d27b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads