c725270c4f4ac6463314b9b45f547c4b57ab55b57b21f7578040170e063c7d14

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
Size

66KB
MD5

4b886bcbbc062be745470fde29add2d0
SHA1

dbdd70cdbcc081c4543a856a92e7b9d0d25e28f5
SHA256

c725270c4f4ac6463314b9b45f547c4b57ab55b57b21f7578040170e063c7d14
SHA512

318c6d10b0830e9ae5a51eb2f469631f76fd98a01fc881cabd7f3ddbf120be88758e84f5c02218b5ffca533508990e3fc8da99d2f0c16fd719c56f8dbd52e4b9
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZBX5WX5bzqzd:+nyi4Mt4d

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4616-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00070000000232a4-2.dat	upx
behavioral2/files/0x0008000000022996-6.dat	upx
behavioral2/memory/4616-1944-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ar.pak.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b886bcbbc062be745470fde29add2d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
66KB

MD5
a14867c2918cae216631e87d9a49ffbd

SHA1
33bf8c1fa192e576347c4e50c7a00041f9e48678

SHA256
6c1cc31f99aafde921418322558eb076b4dd3782990789fbf7f1411dd0307bdf

SHA512
103dc6749c185bee3141d59aa5da30a4f3ae473fe36e86a3f1aec067152145f1527c8c4e49aa11d064ff684a4515bcb52d414e83a2e4d8bb3edd5c3d4df994c1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
165KB

MD5
f8efc55d93aaf400fe6d35bcf6917e30

SHA1
8021c377612b98bd33995422da1ea87146ba3e08

SHA256
229e2bc74ebfb5bc7bee80749b0ef78355b20b945cf1078e80d5364a56f2a4fa

SHA512
cea32572667650d77cd75f8524bca7bc789b6069bcd01dc469ad9e654eb5c66c48a25a24599c2bdf01e6788b7deb3c41e77e189d48835f5bf0e30b80e091b36c

Download Submit
memory/4616-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4616-1944-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads