4dfc11915fc8aa1d31d6132803fed0c69d6b51d44c0de5aa1fd840ddd009aa07

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
Size

138KB
MD5

55b902397ca78a49c09c1e62bdbf68f0
SHA1

12688dc6ce9d0dc01bf4fdc81810d8d0b4980ea9
SHA256

4dfc11915fc8aa1d31d6132803fed0c69d6b51d44c0de5aa1fd840ddd009aa07
SHA512

db954210787726b8dd2cd71b47df08b1a4cfb4efa663550686d79db78734df8a8aa5739c7a98fbec295a35e9832797defe9a8761518b9f04444f9a5a11318010
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCC:+nymCAIuZAIuYSMjoqtMHfhffPn

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3064-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0007000000023278-2.dat	upx
behavioral2/files/0x0009000000022975-6.dat	upx
behavioral2/memory/3064-1784-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hr.pak.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
139KB

MD5
7149d956d13fbc60bfdb9f14f54a70a8

SHA1
eee02c111236e7e7fd96c3e465a9a6374c3deeb9

SHA256
e1e053eea72ccd356f8b797653ac7ace0baa81967aca1e16b69771d83dd274b2

SHA512
b426728c6ae28ab34821f2091e828754c84f2f81811d60cc220a4781f84597dd1ac58456c7fa2c0727d0a3d422e0a20c1deffcaad3b1c7d817e95c6f307b5ba9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
237KB

MD5
56756348fd317aff4af1489de5636b50

SHA1
ed39aeecd3d6732299eeb8deffb13991d4fe9219

SHA256
00b0f3cacebea3fa815209acc0a377aab67688008a218010aede97d3d1e11735

SHA512
fcde5b7b60bc81c7baa7239eec802451973f028ebe68c71cace47619bda44d04ea0a3d20b1b9cd91c1d97c89293660ccf1430d6f46cb6936e4a8ecefd33da482

Download Submit
memory/3064-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3064-1784-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads