319e0d17cb3425665b07a380e0227256ee0d68bbea426733dec4d02096087b0c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
Size

74KB
MD5

654e42ca6b9191cc953e8c6eb6e5e280
SHA1

90e1f485c10a07cba603c392817843080b59849a
SHA256

319e0d17cb3425665b07a380e0227256ee0d68bbea426733dec4d02096087b0c
SHA512

11ab1620faec2c0de26ba3f0b2de2a18047a48e996b34e88035ce30d8b19c25982aa8f42a92d24fa24309c97ce5b1acc09cfe65f56ed14431fd8b2f2db54ee8c
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUs18/8ixO:+nyiQSohsUsOkixO

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4829) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3976-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000600000002327c-2.dat	upx
behavioral2/files/0x000800000002295a-6.dat	upx
behavioral2/memory/3976-1804-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\654e42ca6b9191cc953e8c6eb6e5e280_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
74KB

MD5
71ea87760f565f4e74bbb9fd0d543704

SHA1
e6678efe4f2586425d4782b4af4cfdcd55c6c434

SHA256
46c73e602a5b72264cc861cf6785395c93c1e15d7fe49d313edd17ff725f3afc

SHA512
3f5e10c87ba316b351349072fc811f9a7747c9391fe945423d81a88238a6ac5ac4617b904e71f13678599c19c443c82675ab22bdbeb1d6a1cd5ca6b3aba71d55

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
fc1400066460abac3cb2e00e372d10a9

SHA1
9fbd4aa9d61ded781211e8c85f657abb970601b0

SHA256
4dead42e5697c985cf734f58f9d7e5c80cead67ced686e7f0df2cc2a958f8324

SHA512
2af773b19c4eda976578e0d77d5312a061285cfb9ec5a44e4c53a23dfd87ae05705ed10bfd7403fdf6aa4a6f156342640039db9b7bd3d5e7d29352279f020324

Download Submit
memory/3976-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3976-1804-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads