4935252370ec5f68f8b5f6ae7486852ce5695a8fa590a7bfe1f6c93af21a5784

General

Target

4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
Size

47KB
MD5

4a58fe6a471575bbd67b8fbbdec341d0
SHA1

6d0072c72a6a0845f58f96bd438c284680e959f4
SHA256

4935252370ec5f68f8b5f6ae7486852ce5695a8fa590a7bfe1f6c93af21a5784
SHA512

6a38868f7d56a0af508fdb1bbcf3a8cba30d960eb47f0d080703ab33d8573b3182c4ccbeaf732b33864475d4cb7fbeafee430292d929cc4f061743b5da2a199c
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFax:CTWn1++PJHJXA/OsIZfzc3/Q8asUs18X

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2980-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\ExpandExport.mp2v.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a58fe6a471575bbd67b8fbbdec341d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
47KB

MD5
bf0d7bfc578c7a395dbf68c11bd1117d

SHA1
2ffcf36c1c34387bf27f35d7fc543b8104c77f61

SHA256
827cf9f2721fc2a958ed5e5da54bde5686090babf47357d8e3c1611472b186b8

SHA512
9869ee3ab3d84c1d7ed60a0b3cc511f51c46ac3865a1588c553bfd4c3fed5c102ec391212cd98e26e9d3ac9bdb2783d253ed74e9dff7c7a9cd455a46108e1e03

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
04835aa1ccab5962c62f462b2fc382cf

SHA1
1fac82740052a7f8860ad825a622c06a771089c1

SHA256
8458cfe131327c9ad385a231c681b59a5c825f47454a42b7ce0af6d696de9ed0

SHA512
4889b187caddca9363a16bdba56134be695fdde69dac3e6633d86166b37835f2b3b853c7ec11efaa26c4fe89b78b1b77960abbcb70c4957c5479f1acd0664a93

Download Submit
memory/2980-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing