f963b3163b6552a45a5e387be5aa3262da52f5243c88b0e531c8a5394f92f0a5

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
Size 1.1MB
Sample240611-h87bnsyeph
SHA256 f963b3163b6552a45a5e387be5aa3262da52f5243c88b0e531c8a5394f92f0a5
MD5 2c845031355f1a983bf729b6103124c0
SHA1 b6a00349d30fc2054b2b319d34a21b2344618fe0
SHA512 ba0a94c2bca7d076f320f25ed42969deb75c770fafa99e6ab5445502b02e05ba912cc9526df53724b5dba4cf98b6af4b0cc4a8f69e2aeae033f132e97ed14a2d
SSDEEP 6144:KiQSoDm/UstyCNX2ufOy6QaZO2Wro9ELf:VQtDm//tzXg2aZO2wo9ELf
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2964-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002323e-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/2964-226-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Drawing.Primitives.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.AccessControl.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\hostfxr.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.Common.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.ReaderWriter.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.Lightweight.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrgc.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NameResolution.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Quic.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Native.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Handles.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Parallel.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2c845031355f1a983bf729b6103124c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5072 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 1.1MB
SHA256 819206a99b15c14e3ec920cc2dee109d344c6f22e0f11de15d659a1e60117bda
MD5 57388aa5f50e4815bcb7b7f73eb8c7ec
SHA1 943a0bf7719303bd57b8899e2ecd356f9f3a1e5d
SHA512 0de0434237095c50888b139e139f57d3bec189341662fcda0edfa8710caaa8bea285dc89e2e4e38d459ea2e707e11c1ccd8649f6c05251843cb96abe6e53380b
SSDEEP 6144:KiQSoDm/UstyCNX2ufOy6QaZO2Wro9ELj:VQtDm//tzXg2aZO2wo9ELj
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 1.1MB
SHA256 bd8199c1469e533768a2fb508e11c3002c06397a516725f97e2e23bea0fbafc3
MD5 7fdfbebf776325389b28f7cefea3901c
SHA1 83abd52b90879b8fc77f62de3cd4b8916eb75436
SHA512 d82c2c954566ca31e6bc5b07bee8c6b0158444e57f95adc312ec6623d3cb56a7b64d72ee1fbe7a0c948b49136efecaa2bd364460b70debffe8b38b57ae14a76c
SSDEEP 6144:KiQSoDm/UstyCNX2ufOy6QaZO2Wro9ELk:VQtDm//tzXg2aZO2wo9ELk
MD5 SHA1 SHA512 SSDEEP