ef8d261c1d422948a78822241d313a3f3ea8572dca0a73924dcb9a353f3ae70c

Analysis

max time kernel
152s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
Size

117KB
MD5

6c6dda23ba7b7cda65530b47e6789230
SHA1

140963b8ea4bb38e5ee7bccf7eaf4280e3efbbcb
SHA256

ef8d261c1d422948a78822241d313a3f3ea8572dca0a73924dcb9a353f3ae70c
SHA512

715d4746eaf0240b1b309b108db84dbfb6758cd47bfed17f9c2df9c1e684f5e91c41a3e201ef2d37dbfe78e8dcdf44d3ba5bdcef38f59b197c20970e4071aeb3
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfliG:hfAIuZAIuYSMjoqtMHfhflixim0H

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (563) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b00000002324f-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/4664-28-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.Core.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-2-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XDocument.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Extensions.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-memory-l1-1-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Dynamic.Runtime.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.DataAnnotations.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TextWriterTraceListener.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorlib.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Windows.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c6dda23ba7b7cda65530b47e6789230_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
118KB

MD5
d2d00b7cd5ebbef9852cb80bbde88e15

SHA1
1eed484039de7d3e8702e4f1081f92cf9ba978b4

SHA256
d61d9ba69ebfc8828c16650065ade1a6276c8436671a3f2166227d39d1f0b8f8

SHA512
650074724a1080636149d13bdc4faabb3453a6e76f7cc3dc39b5b344ecebb3c982d1cd233e28f61c2784c1e9691ca6c632f9b85c5700031789839214c3e2fe9d

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
117KB

MD5
5b63400cc4c75241531d506436f0189f

SHA1
9246acd8955ca3740a61c86f190b4708595c94a1

SHA256
68934a6532971b101c5acd8e3738661e5d5b8a229eaeae83849b3de94c83d64f

SHA512
9aca809d370cc72d3ff71431f1f29338bfc3ce73b624ddf344ac45918160fa9ff8075bc761a1a68f558b6761dbf16d0cb8460e36b17c05bbd988657c64935f70

Download Submit
memory/4664-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4664-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads