3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88

Analysis

max time kernel
29s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
Size

70KB
MD5

9b1786eb0e494d67b8ea45b94628fdc0
SHA1

143a159629a3fb01e6ca839baf66eb62bcb75181
SHA256

3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88
SHA512

d8154a516609165cabc05e30f3c3dc5b3b0e5878f2004bf0e2fbc3bea138af6f54de583fe8dba3bd82109f806b0945b248192313fcbd1c51fa31b8f9290dfb45
SSDEEP

384:yBs7Br5xjL8AgA71Fbhvhwfziz63rmreaL1bNawZWxoQD91F4AsiGZ:/7BlpQpARFbhWGUKBb4JxobNx

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\CloseSend.MTS.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3383b6868b370e2fe6ce6a3eac79a090b8ca7d5ede02613e44d8ef5d706aeb88_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
70KB

MD5
0941f22df82a4d83c735641e907572ae

SHA1
8c22c5c9ddad946b7908f54bba4ab23d7b60567b

SHA256
670b9fbf3b44cf3b96023e381f0d131e89c67569bc33326ace390059456c69c3

SHA512
f087e427823a1bf4fde3b31e50d448118a85f5372d1112f32de59d72b4945905a84cab2489f3b1db29f5ee1460bb743f8f1717547de6c8b8daaecc3db0cad933

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
70KB

MD5
5f1d4109d94ff6294c992e4944edc3ae

SHA1
210da31d541db6a0fe8d75e26c72801c376efce8

SHA256
4ee1209dcd02fab46f20b8dae7b100d72d03c747b4188aa128596f52e04ee984

SHA512
bfdbfe119b13a444c7ebb961d188af109bcb046f40dc10fcb6bbc5ed775c48c4a27cc489a267a4ffedf59fb34658c22c513c2418b70d8c207dc7481b4b1f4334

Download Submit
memory/4076-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4076-428-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download