54cd3dafb34874523f5c434cb586b3b100d66d380de8d28f780eaa8aaaba02d5

General

Target

293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
Size

52KB
MD5

293036e8a06422c14701cfaa99fcf870
SHA1

f93602d29b5e6cd5b26c52c58d7357edb3259ae1
SHA256

54cd3dafb34874523f5c434cb586b3b100d66d380de8d28f780eaa8aaaba02d5
SHA512

df05faf5ed4119076e408456aede00c0fedb8282b796610b9b675a871dbe544907d271e7b4f88f7ff2fcda562b55d5c33983efd5f5e681a8f53425a28f9c63ee
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFs:CTWn1++PJHJXA/OsIZfzc3/Q8yig

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1393) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3672-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/3672-322-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorlib.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\PresentationUI.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsBase.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsFormsIntegration.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Overlapped.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXml.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XDocument.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsBase.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.AccessControl.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Input.Manipulations.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Primitives.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\ReachFramework.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Presentation.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationFramework.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClientSideProviders.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\vcruntime140_cor3.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Loader.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationProvider.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Process.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Primitives.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationTypes.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\ReachFramework.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.Client.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\293036e8a06422c14701cfaa99fcf870_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
52KB

MD5
860e95920aebc564181fd4e913be0dc5

SHA1
3eb9dd6ac2d1380548bba1c21dca12b60aa9ca0f

SHA256
b1449b2fb1d9ab552f792d48c9a18dd90ce7f51f056078d75e08f4fbe51cce8e

SHA512
0669a02becb742ff624df7e8d7737c361524d61f71be16e62003f1bcbdefad8f882f8aa5a03292070ad046f99d6a12fbb7e921659011ccdf7eb9baa08456b262

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
52KB

MD5
c9b35a0b37ae28f8134e131cf65d14b5

SHA1
dbe4f92151f45c753da1775b5a336854c67c6b39

SHA256
508e9855d8deee8ce2f94296a805abd97043ea0016bb800b4951f81e32b99ca4

SHA512
b8d58e8e474784e0a966bce218a347648cd277bc3d0b87a6531a34d077bdf39cddfae74d8c54164743217747381fd81d26cb1a5211b4d85cb4339b67533a85b3

Download Submit
memory/3672-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3672-322-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing