7188d5c8860f84eae4d0aa154a91a870ba0d2fce5568620a3fe696ec0f0527c2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70e26914a66fea1fb68017fded463520_NEIKI.exe
Size

130KB
MD5

70e26914a66fea1fb68017fded463520
SHA1

30fac7972c6410ce78c5895d858a3fbd1c5e28a0
SHA256

7188d5c8860f84eae4d0aa154a91a870ba0d2fce5568620a3fe696ec0f0527c2
SHA512

a6fc0cfad8ceb675859f2cad5686810b31123463afaeb22f9685740d1ef029a83ea6fe9ed957e5c4303a6071a5f477b6c8e465202a667b8e00d86a2c4995f792
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCc:+nymCAIuZAIuYSMjoqtMHfhfqnG

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4831) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4376-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b40-2.dat	upx
behavioral2/files/0x0009000000022970-6.dat	upx
behavioral2/memory/4376-1620-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sr.pak.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	70e26914a66fea1fb68017fded463520_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\70e26914a66fea1fb68017fded463520_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\70e26914a66fea1fb68017fded463520_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
131KB

MD5
9c389affaf15ebfffa5c3064a2559307

SHA1
2ddcbbd276300d6c3afeedc2b48964785016e3a0

SHA256
30934d95140864c4fe134e9050f66f2d8254d6d3c83a5615e991ab6761a934cf

SHA512
d84c99beb2c73282e83b3ca66f714001e2c84f1f6a10c4b9cb88e6ff8bc8284a29188575b02a526f2f56f2384919a722ce22ad2512858ab356d4aef4873117e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
230KB

MD5
1e639b5640aeec2bf3cb95675d1823c6

SHA1
22c192a96c054ac998cd31b4d9fc06d0a4e4ff70

SHA256
161ee02fcef32b87942bf8b90a90d831ae3f13896dcfb5400fe9b4a1f49909eb

SHA512
5fb9f0a71dc3fe171400f73ed64f0ab6c5a19eef5405e6969ebdd1016c48aafe210bfa6aed50e0da92c43bfc1cbc432fa1d425dd2707e424d415dd8f80d01474

Download Submit
memory/4376-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4376-1620-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads