1d91a9896a8fa4d5749583e9eec37091974d43c8f2bf0159fdd00e629d148cb9

General

Target

acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
Size

52KB
MD5

acc939e0dff9adaaafd121c798ae2920
SHA1

fb54cc4a1098bb97b901a2a96251f78f34c53d96
SHA256

1d91a9896a8fa4d5749583e9eec37091974d43c8f2bf0159fdd00e629d148cb9
SHA512

8fa34519df5f020b5d6feda9dc26c984eecd756aa63818ea38453e777fb95ed73dfe90b55180d5198f947477d97deed6d51941888ebdc361f1a7fbe4f3720ecc
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFV:CTWn1++PJHJXA/OsIZfzc3/Q8yiZ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2988-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/2988-1076-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WEBSANDBOX.DLL.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\acc939e0dff9adaaafd121c798ae2920_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
52KB

MD5
65836a0ac64433b8b76b1b5a340459a4

SHA1
e664978b816990dee9d8fd33d5b0c90bd91d4ddf

SHA256
32812198ee791bc7124b6c401add5db08a5f2b513b7e2247c58d9e8b11bac5ad

SHA512
8dd6bf7b64daa59ae790a87226b8ed2310929492d99d35464745292b872c9f92ac68338974db2bb5420d4e11e3dd2a6237b1909ad2ff163119fb73652d890a7f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
6fd0e62c6a195c67a0841863b8465753

SHA1
43b6bea996e06fc46235818452abcd306dab9f2c

SHA256
896e473d07325b686645bb25fa0e78142b1c2c090d4085a3dbe8ad57c873a965

SHA512
24582da13f2eb1e8807fd873bf5d9b63a7a601157c0b1a466dbc27b92e1568b0bc7c1bb4bd8db6ff69666bc66f5f080d58ecdbbc88e5ef27e37e2a86742ab2dc

Download Submit
memory/2988-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2988-1076-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing