4e1dd705b8d685dde0697e9113a2a9713929a9e238f12ecdde84c64f2ee1d027

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
Size

103KB
MD5

138cb84511b52d3a3d5dcb6e8543b950
SHA1

21df0af91615b997c5967a784ac26cac75165f95
SHA256

4e1dd705b8d685dde0697e9113a2a9713929a9e238f12ecdde84c64f2ee1d027
SHA512

0ffd6b360e993878a58cd5e35a9dc98acb2cf0b251f74cf6d0efe0e2b97e2a1159a7a890dfb291cebff40fd54e3577c1f774290532a2679dc9dbd30937acd6d1
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfy:hfAIuZAIuYSMjoqtMHfhfy

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (479) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001441e-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/2320-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\AssertShow.inf.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\138cb84511b52d3a3d5dcb6e8543b950_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
103KB

MD5
7829571d8f4d608517f42aaec77bc599

SHA1
d7629663944e96805525cb0b9db95f45579ebf76

SHA256
37c41b8b79c24b9dc8a89ee02ec420196bc426a1f1298a118865e65fe46489da

SHA512
a47d8772ffe8bf5f52d06cfddd8e14dc81438e47062d5957eb5e4f45216d8f4bbff157b2c486d83c1d360c312e7e6a8791170ccc764b174ccfd7f310e758d774

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
112KB

MD5
eac5dcc2be0d4b29a6b7799d06fbf056

SHA1
5339dd8290cac50c72dbc22be8012d9e4263dd0a

SHA256
11af72ab079e5d0b950c9d528803674be3251647f0e10e1c8758256ccb0134de

SHA512
93a2f5a9f905ce607a04a97bcec2a4fd32d26183bb3a37c4ef9264a715fb8494db3aa9853d23f4775d2b5d8fd97dd7e7c877e7e9e731ad2f0aab32d3de4c143f

Download Submit
memory/2320-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2320-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads