a159341fbf9cd09cee8daf0e5ccdc6e84bcde9e8375456b9dde90756011633a0

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
Size

37KB
MD5

0329c7f617015261f3b8fdd5c743e810
SHA1

395ab8ed1d2385b771128834a2c09574b0be7d86
SHA256

a159341fbf9cd09cee8daf0e5ccdc6e84bcde9e8375456b9dde90756011633a0
SHA512

1a7e025af71213781c581ffa2e91ed5213244b5a63e1afc6d782f0c803607915cbfe20b60f47768f84bf38f1e8146b72ccf02fd2a84aeea6e81ce50507762b82
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNQFMVywVyO:W7BlpppARFbhHF0yoyO

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1739) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Design.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClient.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationUI.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationFramework.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsBase.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Reader.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XDocument.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Xaml.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Cng.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ValueTuple.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Primitives.resources.dll.tmp	0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0329c7f617015261f3b8fdd5c743e810_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3168 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
37KB

MD5
b7b3ecb181049c3102683ee985e03808

SHA1
8b26e98e4d96c985fcfd5dacecaf3f4d1f91de19

SHA256
305e9112de7b66a22135bad3733227e8e46a244b95c3006bfa2bc3492f574d8c

SHA512
e7c705863e18f0579b47e1542669829c0125b491793177cc6577e7e7ddab974ab6d7018588bf5d12986cda0747c8832c7c2bd3b9d473b5534f99dd611eb7ac2b

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
37KB

MD5
bd097b0cbeefcc8c230e1416dfd8c146

SHA1
b8330c56bbcb284d37a1c56644783a91c5ea5bbf

SHA256
0d7f243fb1b370f799cc930afd01c38365349a55f3027916ce68ed56eea39827

SHA512
4135435117aa6a346eed9c2d94060105301f851e0653a1eb4c957a09d16b1656c6089e825d0d1ca16bc9236f0d4f16d292a4075ed1c2a51e50bcb0b9f6c68201

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads