a5c1c2d98d79490fa582c3fec2dabc78ebf22e7965859597aa8d001247b11a97

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
Size

68KB
MD5

8c2d03a645c3e8a56a1e3851f867a2e0
SHA1

6f31344902006c98ff309fbd5c4191a04ae6edc0
SHA256

a5c1c2d98d79490fa582c3fec2dabc78ebf22e7965859597aa8d001247b11a97
SHA512

06e2ef4aa958e749c98692973f36f59e884e2b17d67723d3c09cb6c86c2141856da44e0f38c50906b16561bc05cb206d00869714a3e0b40766ddb68b3f6fa5c5
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8B8/8r:+nyiQSoFkr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2664-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000226e8-2.dat	upx
behavioral2/files/0x0009000000022975-6.dat	upx
behavioral2/memory/2664-1852-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\am.pak.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre8\lib\deployment.config.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c2d03a645c3e8a56a1e3851f867a2e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
69KB

MD5
dc7cfec433683a4a7216289afbbb1a7b

SHA1
f5afcbd4b1955484596f3463351dbc5ebc9df0b6

SHA256
d8b164aca76ba893fe71c7fb47f9dc60de460ef35d2b2d406c0dab62e48ea08c

SHA512
f1f1b30c62dd6d8deb8dbd23c577290389f8454e23f0c18c14fa35d5d79b11f56dbcc5f7e881c1cf664d364d957cb3f9bf5fc1b8ed9f3f26d82162a95fe563f5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
3b7a933e5f84e51704fade801890663f

SHA1
75e1efc623ae9100d76996e90b6384a2472e3b53

SHA256
64de2260ac610eab073905f71ed01161c11be394074bcedd4578d9ddf1d00834

SHA512
94cc7fc00ec4d426d41838fe2c6a30fcab122a784f14d59e10d31e7a43daf7ae6703c26a63c461f24c100ea118f8733ad2728104eaf4822d9b93957efb69db71

Download Submit
memory/2664-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-1852-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads