e2c1f60b7896ea29f08e7d8aa1dea5c9cdf3c9a803e83d9102df634f5d331379

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
Size

103KB
MD5

4a27be827d046ffa1fd92f1f3df080a0
SHA1

4af1e99da851dec9b8f6b35f60af16291a71cf22
SHA256

e2c1f60b7896ea29f08e7d8aa1dea5c9cdf3c9a803e83d9102df634f5d331379
SHA512

c1af50bdfacdc69b3b291da5a602652a4f97c81068483ec06b7e74b69ada3712ceb5c648899a9a4b152754f860a092ccfd48cc880fa7c685a3b8f8bfdfe68e57
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfb:hfAIuZAIuYSMjoqtMHfhfb

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (919) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1348-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000f00000002325c-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1348-292-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationTypes.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ReachFramework.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Luna.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.CSharp.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Queryable.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.Windows.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationTypes.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsFormsIntegration.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Primitives.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clretwrc.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Expressions.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Primitives.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Primitives.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.CoreLib.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsFormsIntegration.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\ReachFramework.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\coreclr.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.NonGeneric.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.IsolatedStorage.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Primitives.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
103KB

MD5
d0bda6b9f3e58a2a1d771a7a0420f935

SHA1
647e627d453a3ca956eee14f2b7f7969661cf342

SHA256
f45f8d6d92e4183f6a3c4f43af9adb5225786857903861ba5aefa250401f5152

SHA512
34715edb7296c9fdd765c6380604b3eb51d2d4d6e2d2b3c51ea067ad8c028d9bd6b30ec4466e81a0f5e1dc57d04e67495ce3d23dbb3aba9fbb9d0a12678083b5

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
103KB

MD5
3892a54cee1c79012be68daf4f7c9aca

SHA1
1a0ae3ba0ab35247caa2151155cdf53c67f6215e

SHA256
d6848675038d5057f1536b56ab092f75fc6f04626ae553040f08be4969f6299b

SHA512
e908f20ad5687bf30e0641b75a13b75ef846cd13a9f29de8a45ef5da7f68de4d083081f6cf061035332afdf7c3d451b98aa165235dd214d40cf634b31dbeb564

Download Submit
memory/1348-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1348-292-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads