53c864b18c6356bfe686b33f1a246670c229e222cb52e8ab0adef2df3047114a

General

Target

0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
Size

106KB
MD5

0688130e6e945006f2472fd31a8bbdd0
SHA1

7129c18c26cb82044925acd1715f38ca5460052c
SHA256

53c864b18c6356bfe686b33f1a246670c229e222cb52e8ab0adef2df3047114a
SHA512

1277a63009437553eff46191db849ef5c2f5065ee540ff5469aa90cc3a59a6aa13fd57e88eff744ab7b71e3b81ae38a77334a545309f4c2f77bb9ce146a5351b
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hff+I:hfAIuZAIuYSMjoqtMHfhffPh

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4716) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1192-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1192-892-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0688130e6e945006f2472fd31a8bbdd0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
107KB

MD5
966d3ea0d6cdbdc54f3b0213b5ff56bb

SHA1
24aca8403f12787d9f8695a6909161a185618da0

SHA256
73cb22c083cb6b75f5d0b5fb18978d038531b4d70237251518a4866f6b42535f

SHA512
5fdcb8858af4e637908ce4210159dd848c91d8b0e4f2070768befeaeff684e8c636e54bcfd5450095ca05229a012ba62a99d162bad79f84a2ce32cae0deefbba

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
205KB

MD5
4ef0f6a69d38c06735b88c8b362a7ee6

SHA1
c93ae08e1a2d7daa8dd7f76ac37ce8383053709a

SHA256
c4fa557105420968b61ab9735aad869d9eb66fd353b2ae4b2ab411a546bd9c16

SHA512
c7fe3fa4a79aae044d6d2dc37a62c218b661b615a5496cfff283ac8497df885857486ab5d145ddca70aedc57b6bbd84caea1cd947709e462685b458e41c82d1c

Download Submit
memory/1192-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1192-892-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing