69314876d09887ad6b6a2612fe21f0f11d9a9381331ab62f7f8b444cc133e8a2

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
926540966292571282bedbe21df70780_NeikiAnalytics.exe
Size 82KB
Sample240614-af2xgsxaqa
SHA256 69314876d09887ad6b6a2612fe21f0f11d9a9381331ab62f7f8b444cc133e8a2
MD5 926540966292571282bedbe21df70780
SHA1 c44c699ae33fc7e7d386a7d291d8dba4ca309580
SHA512 9ce2e6d73e50e8b9440fe3987d0e3d670d7d4e53a39f4dc1ce85cffc794cb6fe06479e6320c8652c1e64d03a0653eb1d40caa3b1b111054f371048f791b69d58
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOJ:fnyiQSohsUsU
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1093) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1188-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b000000023242-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1188-398-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Process.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ValueTuple.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationTypes.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Configuration.ConfigurationManager.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClient.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Xml.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Xaml.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationTypes.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.Common.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\ReachFramework.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Xaml.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClientSideProviders.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationCore.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationTypes.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsBase.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClient.resources.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp	926540966292571282bedbe21df70780_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\926540966292571282bedbe21df70780_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\926540966292571282bedbe21df70780_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 83KB
SHA256 698de61d5d9ed71b64873d14fc8ab041175bcab3fbf01468f1d82b8461cd2e35
MD5 b739a815048ba4f2371912afab1c6c80
SHA1 cbe67e3fa052a8d7128842fc04afdf3c88842c7b
SHA512 5f0079c33b02769143b012302ed67c87bee4edc21b06837f0dd16e2fe193bf57d4118eb8a493f724c7b4f33b2684216ee9df9c93b241e68850ded7f8de55d09e
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOs:fnyiQSohsUsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 82KB
SHA256 ddd3f111b1e298baa202c75c7ef13db981f8977aa7b66b60dc839a7f0b5c32b1
MD5 81c9bcf71193f1dcdc5f37ec01bbcd5e
SHA1 8342db265588e8224869bfb382d7449df2653808
SHA512 9e2b63e11a6f9ccf7e1737af4b4f4c8dfda6ee40c6dc3b7ec7b0acef18acbab5eed64dcde34e0da94ba2a014b91f477672c62efc770855e37d5fccf107fe46e8
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOW:fnyiQSohsUsT
MD5 SHA1 SHA512 SSDEEP