95dd78c262cc4b96bfb7f31cac481d615140fcc108f404406ea1d251bdeaabf4

General

Target

85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
Size

41KB
MD5

85255f8ab5dd49e3c01fd09fd8ab63f0
SHA1

4ffd2b35715f51059424f4cd3819c4054c3ba8d3
SHA256

95dd78c262cc4b96bfb7f31cac481d615140fcc108f404406ea1d251bdeaabf4
SHA512

ad9ef7c3b4699f6f4f80bc9eee2617a8c5a5f6c9a116bad918578927dd9f48acd2bdd0bfd801d735d3f508ae62bdfc4b32af012e4d648d574f777f58d886eb79
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFv:CTWn1++PJHJXA/OsIZfzc3/Q8v

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3344-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3344-1116-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\external_extensions.json.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\85255f8ab5dd49e3c01fd09fd8ab63f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
41KB

MD5
861e3ce18560d29ef63b9c155d3d503e

SHA1
001b4ce7b165ef0d4012515e691a1478d8fbef82

SHA256
7848d3a8824afba310bc05cf9ad9546040df99d4a77291e79495e4642aea3227

SHA512
68c7cc8ca4747934da38b66968c90a96cd1e976ee60e1d1829fbd8c53284128f2cf9a304bbb62dbccdc25ec27cd18e1a60feec3726b5ac6294d24a55943a1f29

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
140KB

MD5
8aa519330b9b49542b094385d9661670

SHA1
031bfa65ceea2431c8a5053247f9d03fc36ae1f8

SHA256
a00e9f819791ae7fe584977c4dd35e40c06e62ff691e7647fa9d14f7634ecb70

SHA512
47902a876e757985eb24e69df6823784edd2ce1b00f83eb0fcf1b4652389d967b87707fd01278c0cc56d9969588a8fb4346a7c11defbcbae3f73cfbb7e604a42

Download Submit
memory/3344-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3344-1116-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing