e7628e4d9f8aa6a2409cd3a32a43e62023329917e6f7637c329548b34491fbbc

General

Target

597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
Size

89KB
MD5

597efe7905b2d98b687586b22dd29cf0
SHA1

be90b17da817bb877b93b626d258f36dc4f27634
SHA256

e7628e4d9f8aa6a2409cd3a32a43e62023329917e6f7637c329548b34491fbbc
SHA512

193703d240c6ad855657e5898e7b93357026981e2d6f473273eb6bbf6071b18b5b7337eae8d3551f2282c9dc291c044a60e6b9f7e56b0b8f8f67f77dc660f83c
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaX:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VX+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5009) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\597efe7905b2d98b687586b22dd29cf0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
90KB

MD5
91b7686cbad241f0446dfc97cd361e2a

SHA1
dc2940575ea915436cdc957c7863b4fe7a365e0e

SHA256
916f56fa84beca433e577019f3c8f85da5e53c945ea447dbbb15b9c19598420e

SHA512
539cc4fdf42ce9b5b6d0e51636ffbc10f3316d70881cf953fe5eea1fea34e15d86414bde5b061dcaaabed38dcae4b22739b3d45e0be992245342bf6cf89bc596

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
33c534da52952066952470422b963938

SHA1
f2ce33390de140feae4e17292bcc3efed38aebc0

SHA256
291b2b876e1aa6a4cea9fcce80f0af80be576a4fc78f68876b46119b8df72abf

SHA512
414b8e3f42a646aeee622d884397f136691ce2afe8c6ef72e6dd5ad117a3dafcbe6498da2799927c3d45c2a4d919efbbfbbb796dde78cc4a8fbe1be4486c9e1a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads