1e4284b67f896e2caa8b400df41351fa9d6199e8f8ac8e6bbc211862fcf292e9

General

Target

935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
Size

116KB
MD5

935bcb7a03717360f931918877d2e390
SHA1

4fd3bdfcf75da5a21e614011d1aa8eaa4bd4685a
SHA256

1e4284b67f896e2caa8b400df41351fa9d6199e8f8ac8e6bbc211862fcf292e9
SHA512

1e2086fef77bc6baee8b02f674716780916e9cbbaf1c7e0c6ceadddf657815e78be06ac4500e633317d0f8d3eb0fbbb92c5be2586fc51ecb4f5fee743b459767
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxzTWn1++PJHJXA/OsIZfzc3/Q8zxc:fnyiQSoqQSoZ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4847) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4712-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4712-1786-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\935bcb7a03717360f931918877d2e390_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
Filesize
116KB

MD5
9537b09ebf1f667156e12c4373ea205a

SHA1
b46d922a1e79c347eb27b25d5261b1e74d41623b

SHA256
7464e789bf5bb0517683d3f53bf929f0e34e13004f1a0fd7dc1e5e65e754a768

SHA512
acc0bd70a67d40b0708995d55d128a2fa6df008b287b2953398f4a7c813833303d0adc1df9c53639aa66d05b10016a2b80480aec57bb4d2e9edce6c5c7d6fb04

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
215KB

MD5
9223fe679874968ad93fd650c496a709

SHA1
05d1f15361edac907bd36e59ec031395d1e2d0c6

SHA256
3c0be38799428e5e085cf1502d61fcaa609569f00b06fecde0735f4e33992963

SHA512
13e4bd3d3c9d1ec0f5d1a757be08691c859a3fda864ed52f4d2f30525e5466130069a8b18a4602bc7fcc9c58c8b59a5e8a1b4b33a5276131900b57813ce03bee

Download Submit
memory/4712-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4712-1786-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing