67eeab27a4473b56a9c4ef52831d07adfc5c74dc8b941dfccc66181eec8aa8ce

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
Size 154KB
Sample240613-gey8jazenn
SHA256 67eeab27a4473b56a9c4ef52831d07adfc5c74dc8b941dfccc66181eec8aa8ce
MD5 62fc9d28589e8b7920e26504a3165530
SHA1 bf4d5311a2a64d25fce15722930f34ee1f57661b
SHA512 464f9de9e86b6b4a60ca63218bd450a1c5451dc8be7c21ce276bc7c9f020c07e91827d24029fa08328f82a2b3c7a6e080c92250ac234bf9884ef07b640892444
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKNLQspHN0735iRrKQ31SOBeOX:fnyiQSohsUsUKMrNkkbZw
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1493) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/636-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002326a-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/636-420-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-2-0.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Design.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Thread.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Extensions.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\ReachFramework.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.Local.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\hostpolicy.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\DisableBackup.wm.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationTypes.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsFormsIntegration.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationProvider.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Xaml.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationUI.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-2-0.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Input.Manipulations.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationUI.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\WindowsBase.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\ReachFramework.resources.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\62fc9d28589e8b7920e26504a3165530_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 155KB
SHA256 bc015444e9898494b036b2de974795c05f4125025db81add43a01bc33cd91a87
MD5 7b6074ea38d7c9c3f9a3dab65ebcebf2
SHA1 e2821aaa9aaeb2d6313d1d20965b00762f265626
SHA512 60e3d619cb517de1132b2895b05d18f370c1314fe6ce2d9db6e0a40490b744d1f8832b2979c4dd20bf407c3d6d9f8960b8dd0f48c3d16b159f09cb7504163bfe
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKNLQspHN0735iRrKQ31SOBeO5:fnyiQSohsUsUKMrNkkbZ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 154KB
SHA256 9287b94c9392fc993cdd1876e96969bd0d34d17f18b90bf6aa9384b69a5e2e4d
MD5 bdc861383cef775da94a17a61f792a31
SHA1 983de7d757d7ec021f80b8533b7190f53468c36f
SHA512 60e5a1511e35106790f4b93291e386760fe0cd0630dd987729a353108fd20394d48c1de1b2957790016141fdb81df030e9d3c3ff551a1fc8a3b40addda9df23c
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKNLQspHN0735iRrKQ31SOBeOc:fnyiQSohsUsUKMrNkkbZj
MD5 SHA1 SHA512 SSDEEP