17937c3c94dd8f462d9916c566a02b2b8158d30fb7af0e1fa8121231f7f2de15

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
Size

72KB
MD5

4270cee01b5624d674925825d4e7c4a0
SHA1

51b553cc93a01356acdd9da18ebf679a2409e3ff
SHA256

17937c3c94dd8f462d9916c566a02b2b8158d30fb7af0e1fa8121231f7f2de15
SHA512

41e531131cd965207b78022cebb1bba1e1f3d56c9a2dc89bb7fb8075a79d377b646baa8711c40c8aa536625ab819932fbdb0300ccb8519e52786864f71e30704
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/QbUkNdNm:fnyiQSobUkzM

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4750) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3988-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000d00000002342e-2.dat	upx
behavioral2/files/0x0009000000022979-6.dat	upx
behavioral2/memory/3988-1740-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4270cee01b5624d674925825d4e7c4a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
72KB

MD5
30055a24c5bbb527e38affe77458693a

SHA1
4d0ad42614e40391cfc8c2aac425193486213e14

SHA256
cfd10ed668445be755cffb98a9161d06678289d3923cf99d0d519ac17f36e2db

SHA512
fcef6c619ce58a4b722c2cf3e84e298fb98e65ae83aea3eaba2d1287ef0497ea388377b1fb1417bff330d479a416c2efdbe812fcfac6cfa60c3a827516d3411e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
c4a791ced2d09bb42ee09aef5774ade0

SHA1
f3dd8ba311e5a11b515c457c9a9fd13e3db3eea7

SHA256
2c81c91809c7a47dba8c7050a4bbdd59eccf2153abf934e679ab31822a191d08

SHA512
f24dfdb93f05acfb3a8c95216d767849b40c72a09270842b4d1644ad69b9f452379c52f54438661808e7b58888ca0c234deb2a9ebb0a8ebec47e55a4440dccd7

Download Submit
memory/3988-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3988-1740-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads