66a4245a7d86a810b14f7acdc99b5a5cbac77ed795ee82d74ea076d59311081d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
Size

100KB
MD5

93dc5f73d006528814568b1c67ec5db0
SHA1

13714c921e66a15fa58868bfaa31e528290dbfba
SHA256

66a4245a7d86a810b14f7acdc99b5a5cbac77ed795ee82d74ea076d59311081d
SHA512

6cd6e8b6e140823787175b2f6c2a76bc9d06547fa754dbf61ad164a0e92d6894cb9d7fe820a4b17d3b16fb52bf4490c648473af60dfd5b75de786f5238e9f26c
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf5Sg:hfAIuZAIuYSMjoqtMHfhf5Sg

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5023) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3492-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b0000000232f0-2.dat	upx
behavioral2/files/0x000800000002295a-6.dat	upx
behavioral2/memory/3492-1064-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mce.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\93dc5f73d006528814568b1c67ec5db0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
100KB

MD5
873926c298f2dce94a14034da387ba51

SHA1
b9fffb15d7b03933d640a61a9f0a29f650b9d2b2

SHA256
68e34eb8c982b756949bfb0a38fa3e41df452dd93277b20fd4b395f9fb890de9

SHA512
39c6265c328438d805e8c299277151684d43fe13f2561e482cb01bd2a0c26f0a5c3ab2d1ef19cdb84e08f39b0d92255cd83fbf323e406eef2088366754232ca9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
199KB

MD5
d50652d9f0b255614f9e7e123c0064f6

SHA1
277a8c7f6cc5efeaecf0b81dbe997b61a64e8355

SHA256
6ce4b2e01a34f8a93be0c4eccfa17b9b737f604cfafad602d9237153e28414ec

SHA512
0a06f3f41b6b6c19adbca6cbbcc81d0f838ea89ea66546e8996311fa9cabd0f437f573c537173ed193570b316c24173a8ab1c27f168489c738c0ebbf916dd01a

Download Submit
memory/3492-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3492-1064-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads