2571c1281f746554fa3c387e7a4eecec49002a04c8c5548ba73c68d46161e2d4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
Size

177KB
MD5

8e2ac21978c4863cdc87e9d2103adc20
SHA1

41964597ca82de027545936353bba8e16726ff0b
SHA256

2571c1281f746554fa3c387e7a4eecec49002a04c8c5548ba73c68d46161e2d4
SHA512

542ca4f3f8e1af534f962f37f5ac9e8a1614a34f87ecec5bf58266c444205a99d8e9524f2b286bfc957e2c626eab2d575e329b243a41ea61120ff100f936e1cb
SSDEEP

3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIup:JiQSo1EZGtKgZGtK/CAIuZAIup

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4717) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3344-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a00000002328e-2.dat	upx
behavioral2/files/0x0008000000022970-6.dat	upx
behavioral2/memory/3344-1652-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e2ac21978c4863cdc87e9d2103adc20_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
177KB

MD5
40da5eca3bb808c150aaa0e53060508c

SHA1
99d5672ac0787aef05fda06d3687ec8fbfde149e

SHA256
9759f2b913af4457a4da190002f1797c607504849328f2239192f4d3fbedfb1d

SHA512
4372cc2071bc8031820405f4ee1765cbe1f74fc313dd38be8a21c076cfcdf69268474b0588409a0be59e313ffbcdcf6ee15e40f75e654ec15bbfe8a690eab17c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
276KB

MD5
eae09c64b503f54c6408d2047a89e197

SHA1
fd4fd6a0e8a67e19c8993243521194db411798f2

SHA256
9b0b329eee333175a8c34913003423115a7ff67022950a4f0b2020b3ab082bf4

SHA512
1e0da6aacbc0b2dbfbbb09f03ab16c6e7a6179f8dd51be3c5ade574e956f77f77992eadf54649fdf665df32e1db4083731359c10705a6340917c4bf4c3c1316b

Download Submit
memory/3344-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3344-1652-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads