2f6b8fbd862eb5bf3053561520b3368ac305c2d4005ea9062ee8f21622296e0c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
Size

316KB
MD5

c44dc0c185aa9aadffdea5ed13cefd10
SHA1

6c55b67748b0bc03eadc8c23031add8c887c58cf
SHA256

2f6b8fbd862eb5bf3053561520b3368ac305c2d4005ea9062ee8f21622296e0c
SHA512

97c6f3dee117657eb27f062379142409e3cb481f529b10b0c2bd6d1a68b8f347f981c70ee9c9f3a8f4b49c855e92d424426c6defb5ee863d4bc71185312a714a
SSDEEP

6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtI:3PxPir9RyiIuGcKbpaSL4vtI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4584) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\InstallRegister.m1v.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
317KB

MD5
38f81a4d160d7d0e0f2223176fbe1753

SHA1
13d2173fed2e38780d4a1458ff39648af9da6aa3

SHA256
181a36302ff6e658568ca2a5b86d8f56e46416347b746c0d9e36478f0de5faa2

SHA512
15e5951c8df8c435d703fec044e6e0804c046def3011f019294ffb08beeb0d19ceb8d31c63a92ce580e5e659c741414efdb7ef1be97822eaa873bf33d9bc18a2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
415KB

MD5
3a7b55749181b76ceadf58e6cf6de00e

SHA1
9b41fe3e99f766ea83a34cc84bd67d7a3b29abd7

SHA256
80c575bf2c1854249497f1d39d48f6dc434a5ecf22ad6577e7c49cc3676baf37

SHA512
5ad0152e62c316c63dacb7e148225e7e6a7ac22b085dbb92dbf73c800ad6046499045bd7a25bc872ff3c7731d29f978006c35dd5f14bab548d013cb0705d1196

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads