cd34af5489811a1a3f25aa2d6c10870fc9cb2be2beae20c61a4550ab4c5548bd

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
Size 74KB
Sample240530-26lrqsde3x
SHA256 cd34af5489811a1a3f25aa2d6c10870fc9cb2be2beae20c61a4550ab4c5548bd
MD5 6c6fba1a0f7cac294623a601e1c28090
SHA1 d0bc30b2e1848d16480539b74762e6bc13d94e72
SHA512 56dce4ee92798cf6d8311fc34996c28a0f6c553a6358243a0f8b5fd73dc2aee34de323f375a335827d909acfeb3eab47160fa92fcea6090d8d84f6aa147244da
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUs4:+nyiQSohsUs4
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1188-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002326c-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1188-230-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Configuration.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.FileSystem.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.AccessControl.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Ping.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-locale-l1-1-0.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Primitives.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c6fba1a0f7cac294623a601e1c28090_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 74KB
SHA256 ccb11e441e3cf0eae628b9f2cbdc4b58e8728b899619eeab1ee0d29359c72a38
MD5 f6ad67cb5032b67f974e87923e5e9a29
SHA1 cc67e4fa9d223354cbdf04db4567b7a55c810c09
SHA512 2f1e8c77babace215ead921038e13651659469360610ef656a269e2e30f8dbc3ac3943c2e90e858c0d3ba65d59613f6696500da42fcd1216a897486817f86858
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsM:+nyiQSohsUsM
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 74KB
SHA256 7299703561597817f630cf9d4da056eeee917d90cbe859f213293e924488d663
MD5 5754cea4010d689dd87b497364cffb60
SHA1 852eccb249df817d6a81c6c31d21df5213804a1a
SHA512 7e9fddf3eb158d353c099f8870dead8122e3a6ea3037f90653f287e08092b63ce505bcd6c8e7b4e4a819160785fff512a2a8c4c2eb7398d2ef975ec6a9607247
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUs7:+nyiQSohsUs7
MD5 SHA1 SHA512 SSDEEP