2d3ef8b6e10c219adccc4c1d0d697ef8c51ee77f154d196f2f577169db83f338

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
Size

89KB
MD5

28e052437fd39ca9dd3751d95ea110c0
SHA1

12bce83617183bdd8afdd64b332c1332e2db4de9
SHA256

2d3ef8b6e10c219adccc4c1d0d697ef8c51ee77f154d196f2f577169db83f338
SHA512

a6023b536b02d622aa21e81de1ae98e63df6c9e1a2935a99f9407bc2e34896c35e800d64f6b3c2e91be205112dbb521f8299638ad2ff58bcecc78eee531c5730
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaqv3:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VX7

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemData.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClient.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClientSideProviders.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationCore.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Writer.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\hostfxr.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationFramework.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Pkcs.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationProvider.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Input.Manipulations.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Configuration.ConfigurationManager.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.Extensions.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\ReachFramework.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.TypeConverter.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.DataSetExtensions.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationFramework.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.Json.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationUI.resources.dll.tmp	28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\28e052437fd39ca9dd3751d95ea110c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
89KB

MD5
5e7d8472da2c4e9acfe8e304eb2cf78d

SHA1
64e837508fc61dacc90f53036c336ab953db50e6

SHA256
0cd0637205c376a828040d3255266a46b5ae2c71697439fbe932cdd2ecc39fbd

SHA512
e7ba403d68888acab0a315a745f03b884e5efd2d34d29e72c12f7d3c32a99900274701345c45d46a6e92aadc93031960860cb5e1b3928295ab4cd042ca6bd182

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
89KB

MD5
9a1d806b0ef3b551cb12b21223a4e7be

SHA1
d25f5dafc68d35343d4128c9e97ae3b3f740171b

SHA256
3cbe995081c0955d8a0043a35c7837e5265ca20f5327144fd94a2bb9a8964b8f

SHA512
b9bb7275d995a6b3f70f87bb39049b25304b9ea17569c7993e62d24f01d192cedb8993c6f19e51288145782971b9f0716013c3ecb63399c42b1d6e3744100ae9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads