3e18f0ba30da8827bbce5732884ee5e6010e906acc535bcab793540ceefe0f5e

General

Target

6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
Size

124KB
MD5

6126fe39cb0947dff325b49d649b6db0
SHA1

01d90b095bf7bda8a586acc852668cdf8a223d2f
SHA256

3e18f0ba30da8827bbce5732884ee5e6010e906acc535bcab793540ceefe0f5e
SHA512

5e6e64b18c93ecb56a6fb231f16eeb2915403c4d84bcd3db85bf6d4c94bc5d4c3bbcc063fb63e0f288ffb9139035f1b804e9614642b8dddffb60b70c0827cca6
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC2:+nymCAIuZAIuYSMjoqtMHfhfBJH

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4838) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/768-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/768-1726-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6126fe39cb0947dff325b49d649b6db0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp
Filesize
124KB

MD5
0081f67571d2e7e222df90288f2055ff

SHA1
eeefc0e18d3ed07464ba9f13711331e4d1b52e20

SHA256
8f3cf02814bf54bbbd88fc2a154e9d36fd57fa69ad5d1d4548244a800e480fd9

SHA512
3e65feaf8d64507ca80f854f5ee9f6413e6f66f7371153ec68cb755d2144b9347a9adac14e7498e7a9ad437cad77a0f804620e89aad15b41e47dbd2641591c88

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
223KB

MD5
6a673a869c6a26420d20797883784d2a

SHA1
c3afb1bceb7e059f3a0dde3dae2d9f01a9f22dd5

SHA256
7a48e121a8757f7393edce517271cd51a745b91bc67ff35cbcac0ba12973f680

SHA512
5a2779fbdd9fa88351566bf4616e4d2cfdb8011598c683fc37b2451b5f7ab1d1cc5a7ae9affefc119872395e76ade4013d1ea06f6ce43455655739412f3c17b2

Download Submit
memory/768-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/768-1726-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing