819238a6448c70e0e4e3dd29e43d309194946060d8c4452358c91f3162c5b9ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
Size 96KB
Sample240611-18wt2stfrr
SHA256 819238a6448c70e0e4e3dd29e43d309194946060d8c4452358c91f3162c5b9ce
MD5 083b74fbf848ecdea3327cb35b732010
SHA1 766c47e5b06e3b2ce426be97ca3c0911401a0684
SHA512 0a28f80419d77d666aef47bc9a2386164a9a6ff42d799a590013b2fb67e2f586570eee41b9465cf5fbbd0b210ff97d4bcd1554fedd9fd17ed298569772e365ca
SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulI:enaym3AIuZAIuyxJrQulI
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2432-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b000000023224-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/2432-430-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.Json.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Debug.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Encoding.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Primitives.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsBase.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tools.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClientSideProviders.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Input.Manipulations.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Json.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.ReaderWriter.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsBase.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Luna.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\DirectWriteForwarder.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationProvider.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationTypes.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Xaml.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationUI.resources.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\083b74fbf848ecdea3327cb35b732010_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 96KB
SHA256 a020448bec098c4dba8c6cc4e929098edc04b2e8e091c71a930eb39d364cd5e9
MD5 c7aafbc854b5e03c91444fb1489648a6
SHA1 422f1db9b23448c4846959959022119089f4c8ef
SHA512 37ac5b0821912503bab6402978ca6b03d6d6ea5047eb110cd0aba973db3d4f4c9b68a1763e82ae51778781a9a0884b31e39f60658345ab1bf9c14d91415182d9
SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulp:enaym3AIuZAIuyxJrQulp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 96KB
SHA256 95136ce43e7ea8013d4ed451bb07bfd57226f94085b17a1ea90c26de99f934ec
MD5 081bef9ac69eb3032b5e2b882e758f02
SHA1 b56d4db902e2284914bc9253243c0bb40770185a
SHA512 c962bbc8f17afe33b821dfeed4530ba79abca0f18da116566d0d6848e63360d36e0c64450dbb18fa38bec048814558bacfa798ef84b3d921d0e8d8ba5d63579c
SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQuly:enaym3AIuZAIuyxJrQuly
MD5 SHA1 SHA512 SSDEEP