5dad34a041fb17011769e11eab75c8b4fe9076a549b236b475120a17b6cf6c1e

General

Target

53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
Size

102KB
MD5

53876c85686d678c543f77920d39e5d0
SHA1

047f44963ca9d65baff0d93b01cc5def3b77d5a2
SHA256

5dad34a041fb17011769e11eab75c8b4fe9076a549b236b475120a17b6cf6c1e
SHA512

9ebe68a293c3489aca2ca0aff97e372dc288c0676bb3bee6c724b4c49575dd89d222140977c84d80d389a2c2c74345f8554c5e65c8bf43131db690c441b455fd
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfG:hfAIuZAIuYSMjoqtMHfhfG

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1800-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/1800-312-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationCore.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Parallel.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationCore.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationFramework.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Reader.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Primitives.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Xaml.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationFramework.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.Design.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClient.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.AeroLite.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Uri.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.AccessControl.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.Unsafe.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationFramework.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsFormsIntegration.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-2-0.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorrc.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationTypes.resources.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.Lightweight.dll.tmp	53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\53876c85686d678c543f77920d39e5d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
102KB

MD5
ec4025fdfccb3f41f8fb0b1342ca81d6

SHA1
67874fb48665828e97a44e33092b2abaa586faef

SHA256
4b018de2a0c2e26f5c079cd803f2f178debe591055106c001b372379cc44d502

SHA512
70dc9eb6e96edc62b0964d66f6ff4b2e5568aa20a3dd8df942c0ceb560fc8a8f21e349ade348fc48721aef37026a529fa679fba0a837d488b93efec542ee4958

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
102KB

MD5
664ad7d1fd87ef7dff974e6c1b823689

SHA1
e1fcbb1d12d9c4b1383aff4168b3cbf491b170cf

SHA256
732c91fce138bdcec34fe27f15f89d6f9ee9dcdffc78f423bacecf44ca99944f

SHA512
ead74ca13ccf7b65c9817a7fce460cd12147a6aa44b5ce6867c26d9bbb91da6a61f3470e764a00c51d0441e5360ba35f6f4d450fb1c31ad386c1ef8346081566

Download Submit
memory/1800-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-312-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing