57738c6c89801c89c99d93c524e914ecc1f384d05d02f49098ecea1e497f53be

General

Target

54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
Size

53KB
MD5

54e01dbafc698e3026190944909278a0
SHA1

179f4b4525906c95da84f71bcf498bc4cf6cd13c
SHA256

57738c6c89801c89c99d93c524e914ecc1f384d05d02f49098ecea1e497f53be
SHA512

019d5cea6da96be5436bb0cc73791cde80a6c337cd64c079b678d4c813d4420917068958985985dc6c0b7c3adde5ab280a2bed81cff4385e371d261293c99119
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8yiuaa1aaz:KQSo1aa1aaz

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5030) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4892-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4892-1084-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\ConvertToApprove.AAC.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\54e01dbafc698e3026190944909278a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
53KB

MD5
fa375ccb3a87401820f5246bcdb43b33

SHA1
6dfcc4d8175e747de11ed01858269261a2a90495

SHA256
9d99125af257654ced2ba5a9396b71daa307dd2f8d70ac4198df2f407152f5d7

SHA512
7175082d08fba02264c8cd62020cb50c447ee9cfd26799dc0dcc1fc4e84f985f57d3b714e2e96baabdeb3bb29ecf8c162277e8af901b439f0e334f7b0bb3c5a9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
54e7f27d32d517399c2e341d5446f941

SHA1
d34af8732e5e450801aef40d98bca200dce18bd1

SHA256
6bf7ea77f56d6f2c3a0550ed571ce460d67b15ef0e1fb1e3722c17d3b587d39b

SHA512
d125798b2b4f13855b419b251429535ae0c1d32e7996c306fa89e3ab9c6145157a7c71b78d9375db5843a07d4f2032c894298434da72d63fea9fe2739caa384a

Download Submit
memory/4892-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4892-1084-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing