e566684d9f988614ce9ac07ece5469308fa2cf41cbcfc44dcddf96ef474d8563

Analysis

max time kernel
152s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
Size 59KB
Sample240614-gfbtmaxbpd
SHA256 e566684d9f988614ce9ac07ece5469308fa2cf41cbcfc44dcddf96ef474d8563
MD5 a6dca1f852556a844b697dd29bd59680
SHA1 acb026265acd61d9348fd504261caa317abfa189
SHA512 0f9912a53e2253820b1e2b4cc758ddf0e9bb5a436bc6d57988fe0621d5fad5250fdef368f58dac23ca66b5bdfe4b264be4d51d98f63834d3aa03716963d370c2
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8J:KQSohsUsxe+erZs1o8k1o8J
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1754) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3488-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002326d-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/3488-312-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationProvider.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClient.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationProvider.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Input.Manipulations.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Design.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Parallel.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Design.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Security.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\DenyMerge.mpeg2.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Royale.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\ReachFramework.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.HttpListener.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.Linq.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\netstandard.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationCore.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClient.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.IO.Packaging.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClient.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClient.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NameResolution.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationProvider.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Design.resources.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemDrawing.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a6dca1f852556a844b697dd29bd59680_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 59KB
SHA256 05bc52342fbf7a9dd3bd8e83cb8a131f7c2004403abeceb58ebff6ba8ad2ae13
MD5 ee37c9704328f11a28ee16e3950f26a8
SHA1 4044853e1d2780e07a16e97e023d62fbe88a380d
SHA512 891c86c0fcec8d3192e1a25a17f3b89073229e942564f768efbfc3463589f3250581b42b40bcd1fec470d0b23171897cf17c63531be8cb55933f69fb40dc2d53
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8x:KQSohsUsxe+erZs1o8k1o8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 59KB
SHA256 915adeb73d6cbae24c3e08c6e17f64acf280c25aef95756afd53ae429bda0e9c
MD5 20944a26d5aae7cfde785378d0f5e9e1
SHA1 379de836255c1c1e1bc4b71ab522a212a9d1d3c8
SHA512 cb353d5faee4abcfd29223ed22d3800d985a857acaa0bd2d0c8591c20908f4c80b8d0154db962c11d504165238e704125710eb1915b217bfa532989ea4bcb40a
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8P:KQSohsUsxe+erZs1o8k1o8P
MD5 SHA1 SHA512 SSDEEP