d00735926b35b499cef6df14a9b3e7b6fd66bcf2774b9fe26598acd36d5ba8c5

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fecddc364045507f038917559769740_NeikiAnalytics.exe
Size

229KB
MD5

0fecddc364045507f038917559769740
SHA1

2dbee8e747181381975f2e4bd4f8f592429aeb31
SHA256

d00735926b35b499cef6df14a9b3e7b6fd66bcf2774b9fe26598acd36d5ba8c5
SHA512

0fb462db0b0be68493c87a21f6b642631d51ba183267ef56b58f0a63087ee15e8822c93a1999b3611b3f87b7b8d661576528c88ab8f25ea3c6baaa88e014f8e6
SSDEEP

3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIu6YjC:JiQSo1EZGtKgZGtK/CAIuZAIuW

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0006000000023270-2.dat	upx
behavioral2/files/0x001d00000002292b-6.dat	upx
behavioral2/memory/4468-1708-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	0fecddc364045507f038917559769740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0fecddc364045507f038917559769740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0fecddc364045507f038917559769740_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
229KB

MD5
5e234dbedfad96bde5c9c9efd34e99b0

SHA1
8aae40436f658285cb1873ab8f9dc62e62117dc7

SHA256
2b9b9f0df0af80808010f97d27aa495d3bafc4f28105be589ad33ed138382b82

SHA512
2f00e9b386a91c8e975176cde82cf5b357148cee244b0702f50feb9758539c92db9a9813e3628f3fa85d59cc817759e5d4861e09980ae3823282cd80e410b618

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
328KB

MD5
2403f8da99c08b01b43f390fdd153755

SHA1
a3ff8130ccdb61b5ae47f719016f820884db5bad

SHA256
6ed0841930c7092ed5eb157ab91663eed2d462922ddfd214197a73441b9aa6d6

SHA512
91896395b056caeb95d3441d380e906267a4472806b534f957ea27c601d08ad834a3bf35aa62bf1c63f301b9c2d180a6e48ea7a1b296a8aca96c3f02d2dcbc4f

Download Submit
memory/4468-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4468-1708-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads