2df135b55b592de9a3099de74c7b56a25c9c31b3037b2d1de563befddb4311c1

Analysis

max time kernel
150s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
Size

106KB
MD5

85cc1368d47d3ce40d24475979ed89a0
SHA1

647f3c7158ffaad95260ba6738a0b88dcb4d913a
SHA256

2df135b55b592de9a3099de74c7b56a25c9c31b3037b2d1de563befddb4311c1
SHA512

f4868091629fad6abbf82923e5f90c937bc528f2788fe3e4cc72b64a86b7376c61556bc1bea89282dd0695771372eb2f5dd2b1a0e4ddb125e8ed7d92aeec3f7e
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hff+Q:hfAIuZAIuYSMjoqtMHfhffPp5nh

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4910) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3588-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023403-2.dat	upx
behavioral2/files/0x000800000002295a-6.dat	upx
behavioral2/memory/3588-1006-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\85cc1368d47d3ce40d24475979ed89a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
106KB

MD5
81207e3f3446227956c3fb66203679ef

SHA1
a06b257ac2b2f67e68eee8b7a04cdb9f8201945f

SHA256
4bb26be68895ea7cd4958783c437951d72ed231eec97719a11d1501a4f660898

SHA512
55a400c88c633f4869563dc5655e5cc823c88f994e0c8d660780fd0d212596d7eeaac916b9a5ada04474e9508b48499f05840aba5c97093ea86beed31fae3bbd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
205KB

MD5
ec9a9e3d93f4ebdc466052e0a19aa36a

SHA1
8465dd0dab4ec15114108190b3e853743b0dfa99

SHA256
7608e386e37a9dd29948a1719d16c035f27f729076bca898dec1acc69c4e2d52

SHA512
fe2c20aa0e448b96a0cf53533832eba58f7d5d5a21652843fe88def06aae10ff9f41643fd42baf0c016064fb2300a4bea8f935ab237e047c645e27a9848f0674

Download Submit
memory/3588-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3588-1006-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads