707d665e3acfdbb5a925cb739b4bfc59ed79e12291f33721dac3100899cfc12f

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
Size

202KB
MD5

0c2b38b49ed1af31dcb2ec264ba5a100
SHA1

123478781f0360c304f8d1aac23430929cb42456
SHA256

707d665e3acfdbb5a925cb739b4bfc59ed79e12291f33721dac3100899cfc12f
SHA512

6782f0a53535a40384d02b132b7f1c1de47be3b0c33fc4de5c6070c8245ff351af8bcba3b03eccb45a70ef4fdd7476b10edf23ae08fd7574f4e1272e4df0a500
SSDEEP

3072:enaym3AIuZAIuYSMjoqtMHfhfmLIwuyKhr1nOL:wHm3AIuZAIuDMVtM/sLIwuyKhr1nOL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1160) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1348-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000f00000002325c-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1348-426-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Primitives.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationProvider.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Forms.Design.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Permissions.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ValueTuple.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Xaml.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Controls.Ribbon.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TextWriterTraceListener.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Luna.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.CSharp.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationUI.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Transactions.Local.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Primitives.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\dbgshim.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Primitives.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsFormsIntegration.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationCore.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Xaml.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClient.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0c2b38b49ed1af31dcb2ec264ba5a100_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3368 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
203KB

MD5
6eb15e224cefb131910fd5b721429031

SHA1
586b6cff417df50e41fe03f5cdb57797a7866620

SHA256
14a55b4d67ee44921cc0b568c59135af49a4ec70dcddde5bed4c3a4a0b3d279d

SHA512
1f3138856b7c03be67a528b6f0aab594e6364dc26a57ba555a2ffb6c1e99ffde6016266245f0d26a171cf093ac0a3ecd4e615c4b4c1ef9d48aff0faa60057870

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
202KB

MD5
46fef9f0bfead2fb2a0be81cbb3c9bd2

SHA1
60d666ead062c7a4194778cfe1d646de62503c47

SHA256
9e2235c3a658d331be827be9f893b20e903984d6b94303bb0a3adb22246b2e6f

SHA512
aa7a166422ea8c96b489eb159d424ab832cc0b2d94c2624c4f49fdb166455b278fa3590cde64ac2ef9ae64519c2ee9f7b442c356ec0d3db6c1fbd6ac65f8cb04

Download Submit
memory/1348-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1348-426-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads