7223376c0948c36ef3876da65aa72acfe56b856efa8dbb572add8fb60e3c0ac2

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
Size 56KB
Sample240603-mfsd9sbb9v
SHA256 7223376c0948c36ef3876da65aa72acfe56b856efa8dbb572add8fb60e3c0ac2
MD5 a0064e9ab699ead12f6f8a60aaf70aa0
SHA1 c876f603bae69b3d816a5f464aedc91c3d5516bc
SHA512 7e54745637a03b6bef42c0dc86da66ff73ee538bfd6c04a7d4fb93ac62d619ba58d23a2c528f89fbab51b0844b359141a8337aa5efb44757a4c55ae850221ebf
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFF:CTWn1++PJHJXA/OsIZfzc3/Q8yiB
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3580-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023230-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/3580-128-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemXml.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\CompressUse.M2V.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\ReachFramework.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Reader.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Uri.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Controls.Ribbon.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.X509Certificates.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsFormsIntegration.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Input.Manipulations.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\dbgshim.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsFormsIntegration.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Annotations.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-2-0.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationUI.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationUI.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationFramework.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Xml.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Primitives.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Primitives.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\wpfgfx_cor3.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsBase.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Design.resources.dll.tmp	a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0064e9ab699ead12f6f8a60aaf70aa0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 57KB
SHA256 d1973e277f95d04aced36f014f54b3c1acb38efd597912d87ec378b3481058be
MD5 b65a213a0ec386b3d4257f85b36a1891
SHA1 6d7f98647167f621abb0fea09c25ecd5466c2b4f
SHA512 ec1b0cd0e12d550927379e11406813495aaf5deba214849aab14cb06946445c3d891541e32c9178235e76842572063b3751252e9e0dbeedfbc2c7c54657bc599
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFF/:CTWn1++PJHJXA/OsIZfzc3/Q8yib
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 56KB
SHA256 3e497449a5ebf828f31ee30af41f10d1a2bd4a55d4f4a2464ff23454f6aff11c
MD5 5ae674b786e1c4c10727e1951f735b94
SHA1 17be5a965f9b7184abf4d017c6c48f82ff9526d7
SHA512 b9a1d45a558414c3074a404f22e182d4e38faa160fa15cbc0839d27935597755a3b001b2ce59bfb9c30cb5071934ccdb816a89e5d34aeb73a96c611aca0b79a7
SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFT:CTWn1++PJHJXA/OsIZfzc3/Q8yin
MD5 SHA1 SHA512 SSDEEP