646a6b5b4a54a64226e575f20cc43740f13fb32211e8aa01418324af273a20f2

General

Target

626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
Size

104KB
MD5

626b91fd2086bb53ef50c066cb4f1f10
SHA1

39bf2388dfd73fd5d1a92b5c390fe69ccc809a19
SHA256

646a6b5b4a54a64226e575f20cc43740f13fb32211e8aa01418324af273a20f2
SHA512

eecc477d072980c9dcda7e5cddd8a2fea8f1dca805afbe64bb39798d89cd5cab350e50936a9af7e89e14e3b406f07df9d4e4c08622bbc701f8356027ea16f421
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0xF:hfAIuZAIuYSMjoqtMHfhfM

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1286) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/412-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/412-292-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationCore.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ReachFramework.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsBase.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationFramework.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlDocument.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Dataflow.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationCore.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationClient.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.Design.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClientSideProviders.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemData.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Xml.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationFramework.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\ReachFramework.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationUI.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Console.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.ILGeneration.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Primitives.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClient.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.IO.Packaging.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp	626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\626b91fd2086bb53ef50c066cb4f1f10_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
104KB

MD5
5f764e615bcb797cfb0ea91786addbc6

SHA1
99d3b05a87530288f1c93f6e8231fb7828c9ff60

SHA256
70894038fc58edd6b902611ff3a5c8666fa062b3cb48d864458adc3a2bee7149

SHA512
588aafee924a549e034cff9b46f96f7e8179aebe91833ca099fd89c237689b2431b46bba8a005f36213d062e858314dbbc026cc657b0be5f0c4dee3d0f308ca0

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
104KB

MD5
ac58e0b24879fc6e769bbc9607fb616d

SHA1
46558f1aaf91e7cf34501e9dca92fcfd6c9ecc39

SHA256
9b5b16a97a7e6529575b402f5141b7f24bf2200fbdffbc3e20d100b7b16f047e

SHA512
36ec924776308ba5dae6260a7cfb6e2a8134c290963556b2cb65261410938fdf709617073e193c911590f8f541446d8f4faf61ff82c018d0b5cbbdaa7b6ad1f3

Download Submit
memory/412-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/412-292-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing