c3258c255faa67f9313efe1c7a3f15336123348c5c7e8b2ee7c4773a101f250c

General

Target

0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
Size

76KB
MD5

0dc58af3a2c6b0b78d788ee4d5fb1af0
SHA1

634116f6623e99f4b0bc88cea496172377539d74
SHA256

c3258c255faa67f9313efe1c7a3f15336123348c5c7e8b2ee7c4773a101f250c
SHA512

f3ecc04ad1038b1ccbfb8cb6676edb234a84545a7f10e18889f424575891a0df8a180a54d36af5a5d0e9ef248da5896c7d3199b354be80c85b1364715df91c99
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJiU3Uo:+nyiQSoj

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/208-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/208-1960-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SETLANG.16.1033.hxn.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\ClearDisable.css.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0dc58af3a2c6b0b78d788ee4d5fb1af0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
76KB

MD5
da904bcba26e71908e2b525e92bb327b

SHA1
e5779d198d5ee21fd20b4b2aeba44d66694fdfda

SHA256
f9048146c456e30b2bbdddcaaf8feca5277d45b07d06a7b9e7d574ac83878b8d

SHA512
15ba00b0df61bd6f4969565a686c14663f5101c1a41d07d6e26301f9a6fb87029741939df0e1cea66c23e821ac074162496a0b51472ce36118973612dae32bee

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
692e3137e29c1a4c3b4510d5089d1762

SHA1
43f002fefd2b442310a720a5ba3427d676c159f7

SHA256
13b92b595e7d81d56a90af58b2a5713e8c70f697858fe098d91a97a4d3b716d0

SHA512
ad3c1b22dbbd0c2729a1dcadc5bd75ab91010ef5e554e20b1911fbfeab33cd4538444f82ba4f7381d5c4ca8fe873c6d847f11f3830c18c5ac2b2ec6756be64bf

Download Submit
memory/208-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/208-1960-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing