46ec0ae9927885d0a4d9af8358aa8e62f6400a672229957df6ec1f32a592e32a

General

Target

513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
Size

84KB
MD5

513d71eda71ea002c59d10e98bb018e0
SHA1

52070e4fba10afab112b3983154deb9695b2e6a6
SHA256

46ec0ae9927885d0a4d9af8358aa8e62f6400a672229957df6ec1f32a592e32a
SHA512

0b1a5c0f4c5ae7aba3931ce09db51c7c3025028da3acc151a60d8ebcec5848490457dbf98aad089ca693cf05d5f0fc20c26601c616c5b301eca77401f7bc2814
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhK:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hi.pak.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoDev.png.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\513d71eda71ea002c59d10e98bb018e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
84KB

MD5
9e1532273bed308f08ffd5d2bf2d934a

SHA1
6d3d1853724e606240eb7f9ddb0aa506e363ff99

SHA256
54471596337e3277e81b76f7e6fe926a708d5b360bd36a02b59ea4cbf21ae0bd

SHA512
a6bb12299e796d4232388ccb569e814f738e9cf31c4a3c26aa628611be9339577da5a1e9e98a63932465b9a41c8fb9faf7244a75f76052826f03f4e385e09f8c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
12d90148c048b42b870779f9baaa4e8a

SHA1
fe25151b4ef7b9b13104100f8d70ed89ea08e12c

SHA256
7cb9834614b1ea2b4ebf356aa1de0c5c735855575acdaee14c19d3985e56e78b

SHA512
6ff2fc58f568f4931d2cd0ec8b8f78fcfa6ed9dccba3d6b4625159a9be8faa696a072ba33eaf3c80564e56b19735bf4b15c70dd96115b32a1c9bcf6cce42766a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads