329d2b24cdfa8a85bb97b4a3a0fba485fe846fd650da54ee6890d3fcd83bdbc6

General

Target

0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
Size

102KB
MD5

0485bb47947e51d2364ecbd64ca80570
SHA1

74262c3e5154245a5135b1b3e4986669b23558d5
SHA256

329d2b24cdfa8a85bb97b4a3a0fba485fe846fd650da54ee6890d3fcd83bdbc6
SHA512

9a0581c7f3e4f7d0301abc1ab104a82fd7a2600bd11882606f2a66b49a5ec506f347239d83164ca21dc1a7add68ee562b2df05af1074c9b0fe9c05a73aca605b
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfRbh:hfAIuZAIuYSMjoqtMHfhfX

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2992-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/2992-1070-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0485bb47947e51d2364ecbd64ca80570_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
103KB

MD5
9afcf741dcd570ec90b677bb4c967849

SHA1
5c7f22401c42abfb3b49f352f0cc061fafbe1372

SHA256
cf5673013f2edde9a819beb65d76d547f070511ac650f0b31dba07b3bf06a2f0

SHA512
829d6d5b023dff4f521e80ce09e866e94385eeae35e03784f1f89e08ebeab6b5c46f17247b57e0f64d639b15ce716c09eff786c6094d142f43213f6b9a0f19fb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
201KB

MD5
0618e39d04c5b69b7531d2efa779f5dd

SHA1
74b4ae4a948db625a8868dc077c38b12d04fa4ea

SHA256
a8527170cceb9875624ba2ab4f38fa4feef52f64545bafc45052bb04951bba06

SHA512
eeac4e442ff5ba82a6843ec17217ea83e28ee0694b0ae31073a4bbfe5af494d1a7ac78984a742408ebddbd35ec43f8b8ae685a33351f41689c4a59b24f6ccc7e

Download Submit
memory/2992-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2992-1070-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing