883c2a193ac9c1c4901a866831702958793892206adbecb00c4e6e5cd79c1b03

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
Size

134KB
MD5

e8b51060a7c1bba9283aa960fbfb1610
SHA1

2f52bf51aa1a243a0f345c362177af85a96959b5
SHA256

883c2a193ac9c1c4901a866831702958793892206adbecb00c4e6e5cd79c1b03
SHA512

05f2a7b506c400bdea0249d1edb6bd0d749e825693752be9374e25d5db5a40d24cb6b9b55ff8d186193f1919ee782364db098357fbf6cf998a9272f50bb1619c
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC3:+nymCAIuZAIuYSMjoqtMHfhfIPj+Pj8

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3960-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-2.dat	upx
behavioral2/files/0x0009000000022979-6.dat	upx
behavioral2/memory/3960-1679-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\FindGet.001.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e8b51060a7c1bba9283aa960fbfb1610_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
135KB

MD5
5b3154a596cd2a883b07a3f72ca154a6

SHA1
c4936e02827da52c647cf9775cc2b747b6cdf746

SHA256
90ee5970fb5585e2004fb363bbc6c5a336d6ac8abb26e7395fa05ba12ac7ec14

SHA512
f4665c6dfe37cd309ac6d0227645dcfaf200c918e20bb4cca7b14a3d0bfa60d3116a4653745c4f6195f5daa5b56fc285439e043207aff88e723809face88546f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
233KB

MD5
4fdf679063f0314d23ca83d37dd5a05d

SHA1
15fb7ec4ea82f3ecee0bb12863d93c6d27c2f033

SHA256
60907cf6ef6e300b8fbf1e34d892eb5a28221a545fbba21d8359420e7ab1f4a2

SHA512
8c69c17781d6daac95d7e294ab76c6ed2f6c924e0311b2888c2c70e0263c5a7ea7a12f4f409f7ec3eb2c068c8efad97cb94ef8de1b239ef4ca3b2053076b0d78

Download Submit
memory/3960-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3960-1679-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads