9229ebaab2d7c006a5668a5f96845afe038647ba8ada2cd5c8deb86ef56286da

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
Size

167KB
MD5

2545a939d1dc843bb661410e2abfa230
SHA1

b9a9710ba100a4c179c27f93cece6e8732633819
SHA256

9229ebaab2d7c006a5668a5f96845afe038647ba8ada2cd5c8deb86ef56286da
SHA512

b11fba24bfb94320986e11ca6113635c4573f1dfa21f7227ca79a82226d8902dc00033b0791e61ee6be282c3f5f20bf9f191d813201a702c5e5e9b9f3a768e03
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJBP:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuYu

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5080-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002323c-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/5080-34-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\WindowsBase.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationUI.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClientSideProviders.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Xaml.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Watcher.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Design.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\WindowsFormsIntegration.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsFormsIntegration.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Controls.Ribbon.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Configuration.ConfigurationManager.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationUI.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.CodePages.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.ILGeneration.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationProvider.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.FileSystem.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Native.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Xaml.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.Primitives.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\ReachFramework.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClient.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Requests.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Xaml.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.Vectors.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Xaml.resources.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.IO.Packaging.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2545a939d1dc843bb661410e2abfa230_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3624 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
167KB

MD5
7cf08074c9e169de2ac863e9a8dfc735

SHA1
428007e6fd6d6cd19956fdad0f5a68e28fe1c5a9

SHA256
9e837f0246a722cb2fa85e236dc3446803cd05249c750334ad010bb20e7ad599

SHA512
6bfb330bc3562059d38a5cf32db43cda3a94c81bd53f0b9110aa46d832285abcb0cdd163fa4a041da2a362efe18d8a537bed05ec317f1ead46da32bdd4130406

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
167KB

MD5
a45ea535c7f58fbd11070ba2c60fd6d3

SHA1
de86e293b84fec217974753378d7799aa1ea27bc

SHA256
03d6ac0990d74efc5bf6535be141f0a67b34f4567ba4b72f7deca7aebd861a9a

SHA512
43b49fd5ca218bbba13d9869d18b08ddfbdb8491943c188e77fccfc645987af83882cc330c4783da71828dca1ac11dc5bc119bf0163b8cf632085a7396bca5f4

Download Submit
memory/5080-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5080-34-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads