c7ea7a829ecd2482ad41561526fb384e5d12be178c9a4e895d8a73a424236da6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
Size

134KB
MD5

30432fd62f6c90d8242f79fe06914530
SHA1

89af17e5ced882e4e4100c623b7a22f8cde84702
SHA256

c7ea7a829ecd2482ad41561526fb384e5d12be178c9a4e895d8a73a424236da6
SHA512

66d017b6fb5717192cd35f334ed4483cf6208d5d83142d7c562e18be97bc7d48151b58d1723e4447f506b53b5737deec1b0e4871fd63a83cd9538872f7f26df1
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCw:+nymCAIuZAIuYSMjoqtMHfhf5Sskc

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4857) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1752-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0006000000023266-2.dat	upx
behavioral2/files/0x0007000000022983-6.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-BR.pak.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\30432fd62f6c90d8242f79fe06914530_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
135KB

MD5
f84984814ad25162259cedbe928f8192

SHA1
5d82a4b431aa5c7a1b3585374ac49bfa6f1c3212

SHA256
78d6b8a48ac8ea0d03a9dbb363ef3641b2e90a76bb3962cfc6023ba6f8e03965

SHA512
621cc3e307eb53a3995b704edf5bfdaec2db6ad3a6a26fe8f074ce2a510b85eb354660ab13f04ef4b6425e2ca8c805b486764823d648f2528349e7f694703f4e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
233KB

MD5
f333886fb900a17358f13e39ec29bf3b

SHA1
e73436cb20aa2697748cfb3f269e83c9db40bd95

SHA256
4a9e09fcf0076a04bb635557c6f0066ffc96ca8991d725d3bd64d77aa69d566a

SHA512
82350aff5e6b9c6ca2c430d20348a7972c488dd996d051cda7d63dccebfb0d19f04f8b113430ab11bf97d74fc8f5550a3769d17dcc0395fd99bfa6979a9e93c8

Download Submit
memory/1752-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads