da9a50cc57e3038dcb1c3dbc7af301ce8aabbd5552e35ab0da749b79a782ad9a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
Size

77KB
MD5

99fa8022abb0ac366fdcd1dc7c2bf890
SHA1

4788d3c662628a8f57b8fd76bc592a9d0e32e2d3
SHA256

da9a50cc57e3038dcb1c3dbc7af301ce8aabbd5552e35ab0da749b79a782ad9a
SHA512

bacda2fd9ad620635eeeeffd59d575fe4e64032bcba7e8fea01751757cccece51edab4e617f8de981afaafc99293c895dc1602c725e24f4aece4f065e761bdc2
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76uS3:6e7WpP9oVLQthbYY9oVLQthbUvM

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4891) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\99fa8022abb0ac366fdcd1dc7c2bf890_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp

Filesize
77KB

MD5
d5db86ecd63f286e304f80528f9d36e1

SHA1
e1342c17a712df00562dfe30169c60be4b8134d4

SHA256
3aba7a1033de2ee1091a8c6ec5c77533cc012b4612c17909d9ddc3c7a773f3d2

SHA512
19ebfb7bda0da4b18841914d947cefd83960f3abbbcfa181ff60c9560cc6c73879aff35cdc6f22cfff485721bf66e783948a4bbf1d2518fb1796438a44fee7e7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
0c692ef6b65adec68238dd7de8dd70b9

SHA1
2f1e74e79207920d7b23408fb6ca7b22ca3e4a7e

SHA256
0f14032d5c5ac97193d11d82eba0f8c7ee5fafb46e426e8e8253d2fa2ceec736

SHA512
1a90bb51520599a1751bbd27716db53b01c29e3c32a7404401ddca102ea06a9a8f680167cc0e8513a00606c6ca87aec407bf1cb46d23b7fc9d3764e6a6e61709

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads