327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b

Analysis

max time kernel
6s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
Size

36KB
MD5

b1bb2845282618f5f93e903e05831e20
SHA1

48506d020d487fdb0728b715354e00852c5919d7
SHA256

327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b
SHA512

7d7826d0803dfb1681617700cbd1afc22574cd8c176ffd94a402f9ef040433ffc7038a490971a911c33553038557463a03776dec164e342643413327c1277199
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN2TQ1nrq9SBotHL/XBotHL/k:W7BlpppARFbhknr7BotHDXBotHDk

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\BackupStop.contact.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\327614ecbf369a3a766bb48b3077d61cf3af57069c0f96a552fa5f4d21eed23b_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
36KB

MD5
b3c0f1de0f595f5b97374e2713063f9b

SHA1
8f5ab76ffa9a1892d77066050d42e4091fbe866d

SHA256
df1f0f902541dc9d70529a105bb077d89767566f10206de28162aa297b8a9fb3

SHA512
d3b93575a71e3d3fad0066415ff48a89adad9688f8dc587fff32a8de5211c4a797b46e5300d5c65f049a4253f64d0f51bfab98f73ecd2f70b9b3eb03cd5b9919

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
135KB

MD5
5b977a2333271310eeb6e4aa607e0cd8

SHA1
3726852b1d9e24a59b9534119853cc82d6197107

SHA256
75b713ef4d6f2e366d53ba2c40f0ea46d0c0de2955aada4bfe90976e0075621f

SHA512
60b9fcf97a213720aa989a6e30c15093ea996e496fc4fdab811fb722aaf926eeb4c32c24b5852d6af7280e46a90d237251d0335b5517b2da40bd168f490ce712

Download Submit