6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
Size

97KB
MD5

18bee2084e59fed8869a772644dedf90
SHA1

3d7bcd8599c7f7931d37117b2d203a44cb53c3df
SHA256

6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a
SHA512

f3317d17e01690fc033d9fff1b101aa37b97c3cea02eb9af13b2ce4426aafdfa2cc0749515dd87cf1642d70cc6ac7d422260ca9e3228679495d6e5c4aa14f2b6
SSDEEP

3072:9QWpze+eO888888888888888888888888888888888888888888888888888888o:Lpe+ekeq1+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4841) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6ad3281d40cd820eeb87908f433cc51d7b35e107d558fba695175365c28b7d8a_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp

Filesize
98KB

MD5
e5586af6ad78f9c133cbec28869c1a1f

SHA1
f3f5511fba27c0794f2f29478b9c2743245c035c

SHA256
e8e86172c255a20dc7de619e9668d83c9a37f0d49b539e6fa656726ce58f244e

SHA512
0ecc731084ca037f651a74bcccbd77c6d18f889f4c7ff14815fa0177c1d0df0c1e30c5fc7185636e285d84c8b97db01691e8ef131d361abb0ef03bbfd7afe77a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
196KB

MD5
5edc1df262f74dcaf3bd56ac2f19ac1b

SHA1
5973dce5803f756dfdbcd16391633ac919433f0f

SHA256
0d82e29177321d7737de785b7e37fe6cdc28aff7d5f15d3a4872cb18b12459fc

SHA512
73d4b12205a3172967850c3249f06029bb1e9eb3e20ff68ba10c6c2c8e6f7a9fc4a5a0a86ce6587b33c5073381405b8c89c12e8b217649a9a277c316f3511ebe

Download Submit
memory/4316-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-1756-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads