36540d9f1cca36b351f4253b31138195bd3d4c19d7d3f35e4c0e827afdb33edc

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
Size 90KB
Sample240603-wh3gpafe23
SHA256 36540d9f1cca36b351f4253b31138195bd3d4c19d7d3f35e4c0e827afdb33edc
MD5 e165c89a6417080b33b2851f2c58fdb0
SHA1 31086c6c1fd9023a26ddcec0699191156c220a03
SHA512 96eb4f1e41e7b7cd1e6ec617825533c6fafb30ab6e474bedd64d8549c73a2dde6a08c5542333c936d21ff62697c487c4a91cd7c4ada0799f3ebecbcf35081e75
SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNL:6rWpcOPxPke+e3fFpsJOfFpsJbgE5
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1524) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Primitives.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Design.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationCore.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClient.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationFramework.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Design.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Primitives.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.X509Certificates.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.JavaScript.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationFramework.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Primitives.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XDocument.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\ReachFramework.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.Design.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationUI.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.MemoryMappedFiles.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Encoding.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationTypes.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TextWriterTraceListener.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e165c89a6417080b33b2851f2c58fdb0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 91KB
SHA256 87b0b8cea36657ffc8869eb4525201c7c3dcf2a263325390e068d97cd793b48a
MD5 f7ad04ade250fbcdd4ebfc44d5646d38
SHA1 5626e3880f1fea9f2835c3a82ba1a2add573d6d1
SHA512 9bea7b4f260bc16a5a86a420fe0405a0e50f79e7dc7b04332fc7bcc20a9792fceeef7e9b874a70fa196f0a4b798c97233a444df18c9f06de2ba06b3cbb9ee6f1
SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNx:6rWpcOPxPke+e3fFpsJOfFpsJbgEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 90KB
SHA256 2bdcb8859092ec93f96fc17bf162062880392549712a1f35f56bff205424c151
MD5 61d106d6714a883630cd4c192d500fea
SHA1 485b29bed1f6af93f08ae5a7b91b0e44657a5a21
SHA512 6c68cbdea1883b79a7976827b1b93d36fa1bc64d953d1c380a1984330e109b19f6ca1fe7564bf794ea283265c44050a8f241c1818e56322f43aa8914032d13a5
SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNk:6rWpcOPxPke+e3fFpsJOfFpsJbgEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads