28dfc3c101eb1c3e2cde8d5ff2ca0034588f08296e59db614b65d9f7a482cc89

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
Size

53KB
MD5

2d334375f01b6234b43a027f6f7a3300
SHA1

c212ca83b67183ea2fa3df9f873e1f5df2691103
SHA256

28dfc3c101eb1c3e2cde8d5ff2ca0034588f08296e59db614b65d9f7a482cc89
SHA512

f18fdb2df5b9d2d68d5653331cc6fd2fce5016a5324334a39ba1577e0592d530540d1b1178dd5293c73faec3dd32719cd6f8c2dbd54d24a1c097c0c86c4b748f
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFx:CTWn1++PJHJXA/OsIZfzc3/Q8yiV

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3532-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000600000002297c-2.dat	upx
behavioral2/files/0x0007000000022983-6.dat	upx
behavioral2/memory/3532-1110-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\CopyLock.cmd.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\vk_swiftshader.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fil.pak.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2d334375f01b6234b43a027f6f7a3300_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp

Filesize
53KB

MD5
60a90095b2e7d296dff2bd11b6c1f7fb

SHA1
a62f9eb1fd3fb55abd54eb327761aafc9c0fad3b

SHA256
07dc2c2dbbfa05af31098623bab093b4ddcc2076a2ed445c29ae3b173a6264d4

SHA512
7547d0a14e586677405738caa92f464d3f178919789bf526f16d1e3e59142d36f0de75c5a0b289b4d7850b3a81b4abae35a50f8ad29d7373602d3902e513a0bb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
0cfe147f36398f52c8f94dd7ce62a609

SHA1
124e74f55f6698dd07eae56f163dff65463b265f

SHA256
a91ba6d57a646ef9a2f4203088dba42cb8ad39d381b482c21492701a2941164d

SHA512
aab523154345ea614dd75dd4ae075b31562a7aa01c08e0e5b955f868215bb633ffb3755f7506243d16ee2b560e7d917228030dee9a1a93b6864e899226c6d46f

Download Submit
memory/3532-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3532-1110-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads