36e7708fb06bb6332412462e41aeac82d1ca92c9286980f7eb8ac3410bee87f8

Analysis

max time kernel
153s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
Size

104KB
MD5

750d9de83812fafbc97727d51bd98a20
SHA1

b800e340b55a668da3247350cb64504ee7668260
SHA256

36e7708fb06bb6332412462e41aeac82d1ca92c9286980f7eb8ac3410bee87f8
SHA512

57a7f91e56bda5b887767fa225a2ef37d4a00a485f591cc2187b9cbe91a13cdf8bd344c9b230e5aac67d831cf535822d9ffd5251b291f2ed12c8a6b2777524c8
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf2:hfAIuZAIuYSMjoqtMHfhf2

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1075) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4764-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023272-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/4764-128-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.ProtectedData.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationProvider.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.X509Certificates.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationUI.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\netstandard.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Channels.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clretwrc.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationProvider.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\ReachFramework.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationProvider.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-private-l1-1-0.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.SecureString.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.OpenSsl.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Input.Manipulations.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Expressions.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Resources.Extensions.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationUI.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Thread.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\750d9de83812fafbc97727d51bd98a20_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
104KB

MD5
08ef5f70f5bb786d4dedd79854d92678

SHA1
b4f8239cf8a8f518ea9837ec83e2efda618acf33

SHA256
f541ed5b611fe1819920a3e81209531db45f1a85775e4beb4b1bf40da3e7e190

SHA512
495c278211fe3968ac477835f42c004059ab15c0a714e0e61bdbd1976f7caecce77d17d336fdcac923a899385e1a773d0ed9fe3cfe1780010746e08ea865532b

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
104KB

MD5
2aea7dccb9fca117328f497e4f1d80e8

SHA1
12f5013be232da99329304684030af87090822b1

SHA256
64a7a5d5ec1b6795ad04579e01d644ae3c71bddf0dcba5c1ecc5e2079b6cc73e

SHA512
76b1c3787cff8434cb235912a67b4f9637ba214025d8fa196c842a2084cf39e7ad5921b06ff7add404fcf676796add4a9cf5f99e557b3f24e7cc2585faf60a53

Download Submit
memory/4764-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4764-128-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads