dc874de3fd00b00ba3777c0ea3b460b23bf2d75e276abc3ff277cd9945acae07

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
Size

105KB
MD5

9ea78aae270a0ef695d95915e2e548c0
SHA1

80b3dc9e5d9f86ac7aed063e315a9e394eec43f9
SHA256

dc874de3fd00b00ba3777c0ea3b460b23bf2d75e276abc3ff277cd9945acae07
SHA512

51c1006f73a9833053219a0558e8ca2d859d49c64a5b6f53c13b92ed09d8e5782abdfb58bea5d2b34966f8e735979f17f5a70605791fafd9f6998313d6af45a0
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfO:hfAIuZAIuYSMjoqtMHfhfO

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3437) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d000000012333-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/2420-80-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\npvlc.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\gadget.xml.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Journal\Templates\blank.jtp.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\9ea78aae270a0ef695d95915e2e548c0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
106KB

MD5
20bc83a9b802ae50c4a7760ea5636fb6

SHA1
25e274ae966b22d0cab2448ef225919d91db74f8

SHA256
334d45d3b14fc7c61b7b87c8624cf9edc2d9b6abd1f3db6b1543132609422258

SHA512
60cdc3ba9b4e7592ea3d169f9cd43a669821c6b106c4f87d8227b0e19a8eefb65c8a93884861fa4147544a531b1f00f0189acd6b83a383d6a4e79f9275e85e64

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
115KB

MD5
9289bcae1ba54a35ff9ef478ddc6f75d

SHA1
434522e46428d932b0c3d8e1e04560b7b30c1791

SHA256
ff1b76d6ef2097a26ba8c2d30b34ddcf7f9c550874c9e1d803f0fcb4def495d1

SHA512
2f97342e424084e63a4479e1576b3dba444a0a46e675409120f6a795eec12a7698afc4c16c19941544fa7a2cc5d3834143933502ffa9b80baa1501791a26f94a

Download Submit
memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-80-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads