f64d3262e3de49ad4cc8297b309b498b62485f2e937aafb10e5b02f8576f3456

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
Size

130KB
MD5

246963b57f03adb74e7dc939042cefb0
SHA1

609f76ef485a173920262579919a23bd915a3d50
SHA256

f64d3262e3de49ad4cc8297b309b498b62485f2e937aafb10e5b02f8576f3456
SHA512

021801773d4a81ac9c84508d0e0fac30b80e50e8163ff4c886399c2f9ce20e9e0f2a626e01d96c68a2b88b1f8cb0ed7288fc57f9c3958271ab15333b080dc9ac
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yimTWn1++PJHJXA/OsIZfzc3/Q8yiyg3:+nyiQSovQSoxg3

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4852) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4820-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002328e-2.dat	upx
behavioral2/files/0x0008000000022970-6.dat	upx
behavioral2/memory/4820-1774-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\246963b57f03adb74e7dc939042cefb0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
130KB

MD5
6f532b22cfd5e6e978b4fbb728caab4b

SHA1
bada5fec9533943d9587de81b4d3790ce7e66fa0

SHA256
ca69bb091dc45fa9f679f458bb3a60a2fa445ef34f1b6a83c575698b788144dd

SHA512
85c23779af331e07a7d09371822a85296f7a23e483e52620f59bf146ca7471bf22c71c7b4621a0294fec6a5189822361c33e1c6c764fcf377f41553e25235842

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
229KB

MD5
d7641f68430d44f72ff16c739dbe703a

SHA1
6e6c69c50c5cffb278fdf961b3b5341b54630caf

SHA256
d39e01254730f276271d4dfa9d73f97689e1ccb351296af67d668e1a24a63904

SHA512
f7883441b52062e4090a89f53ee1b3fedaa46eaa4998444bfe09bc855d62fdaab835faa9c448ee5c74d4316c4d0e6a27bd24538fd02214cc4cb7f314a5cb0126

Download Submit
memory/4820-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4820-1774-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads