3691017818d6503e6f7ce2f9fed4b03e4f506484048749c77e680a82ea06b2ce

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
Size

44KB
MD5

4ba1420815bd5eab2e4236543ae75d30
SHA1

72a2f1a854d54d64282e054943caa90166c0dd73
SHA256

3691017818d6503e6f7ce2f9fed4b03e4f506484048749c77e680a82ea06b2ce
SHA512

cceba897eb4da3aeaa6970d5a098633094fac07705542a52012710aa3a29f73c1986a14c93a587e2985f44b05067a782a84fc0530a087bf764a8a9160d7d5336
SSDEEP

384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDk:W7BlpNLpARFbhblkYlkuvIYFWcDYcDk

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql2000.xsl.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriLI.ttf.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AIRWER.DLL.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
45KB

MD5
79f76d635c35e4b523ef0c3a021bbd18

SHA1
f6f33fe70a0ebfd1a9ce8e5df825b8d87bbcd361

SHA256
393927b5428803e5f8ff4928204fe264524a001bd4ea346c3d6da86c89c75155

SHA512
d166e256ace5a83d050a93774dd1beb57dc2e5a95bbf9fe551e5d66b6ac9e8c57dcc9f2a4fe623ddeb6bdfdc73e378890cbe8c2dd2effc58e6a6241f70877ed0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
0bd7a904c6490a86cbe7d29ffe1083de

SHA1
0d463167464bfc6cadd1c7069a28dc06bb267c97

SHA256
cc0a8b7bdba7d6474fd56d95d680d1dd49d2e966346d891bf32957485f73c290

SHA512
b469bb1cb8b43c05dd25023a6122187dcc7082a49df78b6cb03de5e36d01c3b5b25ae2f8b93c912fb7a00a6322208acbbe07c201803a0d4ea1610a00979c6767

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads