36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
Size

81KB
MD5

eef369329e7b2ae045be54e56a273a50
SHA1

d71ed5843d34b1b7c34cdd13bf26803ed1ec539c
SHA256

36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc
SHA512

eb92861cd8b5218914fa9567c6792442718cdf6b53eae4b73d222e9bda95c2801247b81f810abaf196539374811d9e44588b9ea8b09b2e73162a4bdd8485bac9
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJxfFpsJcEKLF/MF/4fxRfx2MlgDDMlgDSCNFEXBwzEX:/7ZQpApze+ejfFpsJPKZ2wfxRfxzdYa1

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5074) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Tec.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WEBSANDBOX.DLL.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\UCRTBASE.DLL.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36755e4deba09a104836dc480cebe65056579d36417728b252afd2d7c82a34bc_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:924

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
81KB

MD5
91ceacec71a9bf50161864d022e102f3

SHA1
4b923a0c9b8446f8cba1b3b7c325cba535dcdfec

SHA256
62291062a5c4f18deaa572d4f611484bd0f4d0b23de94010e1d4eafb2e835c3b

SHA512
46fadfadd55bb0f566a95a3b98c96f2a4d864d0df50f57595d3208527900192b7ffee67f5d118de2b012d1f625a0db732c10105879b036b2b8333f497c58c025

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
180KB

MD5
fd4a9daa3e636d72ad1a61f548503497

SHA1
2f6cda876f9414a48350e1767e8db2630e1186f7

SHA256
bdff1dfbba47395b51ddb353a057636f3f5201e4b781137abba627391765a1c1

SHA512
d1528b65a02b9f3f14a690a07ddde2fe2620ac22f336207b6fdcc33c4460d13364e2a7d9d5aa4675a90e8e97b6c6761c5850b89316c9340c97222d9d736a98b1

Download Submit
memory/924-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/924-1804-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads