b8382232779dd37b4fac6034113de519b011f21f959abb45e05783c450f8f856

General

Target

9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
Size

108KB
MD5

9efa3447ca7d8e5ce327fce197411ad0
SHA1

35135fc5509e5eb7d3316fa43bfa6539f91734ce
SHA256

b8382232779dd37b4fac6034113de519b011f21f959abb45e05783c450f8f856
SHA512

cf1da96bfef854e19d4e2c2fa336917711f65f1b3f3c436d0c0e73fda390d4afca51f1e162261ffd460894d909e859627e77e8fcd76449b4e116be2099788a09
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8XTWn1++PJHJXA/OsIZfzc3/Q8L1m3a1G:+nyiQSoIQSo2EqEz

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2992-448-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.tmp	9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9efa3447ca7d8e5ce327fce197411ad0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2992

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp
Filesize
108KB

MD5
1c3ee13c0b8bf04a5269949887972a73

SHA1
48c69fbc5d5b2ba63372792b6ffb552b0d35a087

SHA256
ce79259e1ee2b96c2b5ae48cc148348a75291ac9c562eff404ce599ef25b7006

SHA512
2872d718174255c1bb2b32bed4022108153d7e347fe3990328772ec2ac3d97c276025a10a0f87347400c12cdce11d51e87f98d34e470770d0ffe9428ee1b746f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
117KB

MD5
9d94119375af885d02f68d6bd18fef21

SHA1
830626bc543dc1c4d4bc4a80596c890475acdbde

SHA256
81d5c757b8d068fabd1bde166953a043fb83cf489988d45f7ffee3a31a7f07a1

SHA512
5fc9e051f1deceaf5e67bb7063f3ebc7c2d93c7ecb3045086e7619a83bff0e50aff06b5c3fd2d719bb04c980d52f4ca7d5a1ca5e26f3e776aa50d5a95e54d660

Download Submit
memory/2992-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2992-448-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing